Dynamic Gradient Deception Against Adversarial Examples in Machine Learning Models

ABSTRACT

Mechanisms are provided for obfuscating a trained configuration of a trained machine learning model. A trained machine learning model processes input data to generate an initial output vector having classification values for each of the plurality of predefined classes. A perturbation insertion engine determines a subset of classification values in the initial output vector into which to insert perturbations. A perturbation insertion engine modifies classification values in the subset of classification values by inserting a perturbation in a function associated with generating the output vector for the classification values in the subset of classification values, to thereby generate a modified output vector. The trained machine learning model outputs the modified output vector. The perturbation modifies the subset of classification values to obfuscate the trained configuration of the trained machine learning model while maintaining accuracy of classification of the input data.

BACKGROUND

The present application relates generally to an improved data processingapparatus and method and more specifically to mechanisms for protectingmachine learning models against adversarial example based attacks byusing dynamic gradient deception.

Neural network based deep learning is a class of machine learning modelthat uses a cascade of many layers of nonlinear processing units forfeature extraction and transformation. Each successive layer uses theoutput from the previous layer as input. The machine learning algorithmsused to train these machine learning models may be supervised orunsupervised and applications include pattern analysis (unsupervised)and classification (supervised).

Neural network based deep learning is based on the learning of multiplelevels of features or representations of the data with higher levelfeatures being derived from lower level features to form a hierarchicalrepresentation. The composition of a layer of nonlinear processing unitsof the neural network used in a deep learning algorithm depends on theproblem to be solved. Layers that have been used in deep learninginclude hidden layers of an artificial neural network and sets ofcomplicated propositional formulas. They may also include latentvariables organized layer-wise in deep generative models, such as thenodes in deep belief networks and deep Boltzmann machines.

SUMMARY

This Summary is provided to introduce a selection of concepts in asimplified form that are further described herein in the DetailedDescription. This Summary is not intended to identify key factors oressential features of the claimed subject matter, nor is it intended tobe used to limit the scope of the claimed subject matter.

In one illustrative embodiment, a method for obfuscating a trainedconfiguration of a trained machine learning model is provided. Themethod is performed in a data processing system comprising at least oneprocessor and at least one memory, the at least one memory comprisinginstructions executed by the at least one processor to specificallyconfigure the at least one processor to implement the trained machinelearning model, a selecting classification output perturbation engine,and a perturbation insertion engine. The method comprises processing, bythe trained machine learning model, input data to generate an initialoutput vector having classification values for each of the plurality ofpredefined classes. Moreover, the method comprises determining, by theperturbation insertion engine, a subset of classification values in theinitial output vector into which to insert perturbations. The subset ofclassification values is less than all of the classification values inthe initial output vector. In addition, the method comprises modifying,by the perturbation insertion engine, classification values in thesubset of classification values by inserting a perturbation in afunction associated with generating the output vector for theclassification values in the subset of classification values, to therebygenerate a modified output vector. Furthermore, the method comprisesoutputting, by the trained machine learning model, the modified outputvector. The perturbation modifies the subset of classification values toobfuscate the trained configuration of the trained machine learningmodel while maintaining accuracy of classification of the input data.

In other illustrative embodiments, a computer program product comprisinga computer useable or readable medium having a computer readable programis provided. The computer readable program, when executed on a computingdevice, causes the computing device to perform various ones of, andcombinations of, the operations outlined above with regard to the methodillustrative embodiment.

In yet another illustrative embodiment, a system/apparatus is provided.The system/apparatus may comprise one or more processors and a memorycoupled to the one or more processors. The memory may compriseinstructions which, when executed by the one or more processors, causethe one or more processors to perform various ones of, and combinationsof, the operations outlined above with regard to the method illustrativeembodiment.

These and other features and advantages of the present invention will bedescribed in, or will become apparent to those of ordinary skill in theart in view of, the following detailed description of the exampleembodiments of the present invention.

BRIEF DESCRIPTION OF THE SEVERAL VIEWS OF THE DRAWINGS

The invention, as well as a preferred mode of use and further objectivesand advantages thereof, will best be understood by reference to thefollowing detailed description of illustrative embodiments when read inconjunction with the accompanying drawings, wherein:

FIGS. 1A and 1B are block diagrams illustrating the problem of modelstealing attacks addressed by the present invention and the solutionoffered by the mechanisms of the illustrative embodiments;

FIGS. 1C and 1D are block diagrams illustrating the problem of modelevasion attacks and the solution of the perturbation insertion engine160 provided by the mechanisms of the illustrative embodiments;

FIG. 2A illustrates the sigmoid function or the softmax function that istypically used with neural network models;

FIG. 2B illustrates the sigmoid function or the softmax function inwhich perturbations, or noise, are introduced into the curve such thatthe correct gradient of the curve is not able to be identified by anattacker, in accordance with one illustrative embodiment;

FIG. 3 depicts a schematic diagram of one illustrative embodiment of acognitive system in a computer network;

FIG. 4 is a block diagram of an example data processing system in whichaspects of the illustrative embodiments are implemented;

FIG. 5 illustrates a cognitive system processing pipeline for processinga natural language input to generate a response or result in accordancewith one illustrative embodiment;

FIG. 6 is a flowchart outlining an example operation for obfuscating atrained configuration of a trained machine learning model in accordancewith one illustrative embodiment;

FIG. 7 illustrates an example of a cognitive system processing pipelinein which selective classification output perturbation is performed inaccordance with one illustrative embodiment; and

FIG. 8 is a flowchart outlining an example operation of a furtherillustrative embodiment in which dynamic modification of perturbationinsertion is performed.

DETAILED DESCRIPTION

The illustrative embodiments provide mechanisms for protecting cognitivesystems, such as those comprising neural networks, machine learning,and/or deep learning mechanisms, from attacks using a gradient or itsestimation, such as model stealing attacks and evasion attacks. Whilethe illustrative embodiments will be described in the context of aneural network based mechanism and cognitive system, the illustrativeembodiments are not limited to such. Rather, the mechanisms of theillustrative embodiments may be utilized with any artificialintelligence mechanism, machine learning mechanism, deep learningmechanism, or the like, whose output may be modified in accordance withthe illustrative embodiments set forth hereafter to thereby obfuscatethe training of the internal mechanisms, e.g., machine learning computermodels (or simply “models”), neural networks of various types, e.g.,recurrent neural networks (RNNs), convolutional neural networks (CNNs),deep learning (DL) neural networks, cognitive computing systemsimplementing machine learning computer models, or the like. Theobfuscation of the training of the internal mechanisms results in thegradients not being able to be accurately computed and thus, theinternal mechanisms are not able to be reproduced via a model stealingattack, or the adversarial examples are not able to be created to makethe model misclassify. These machine learning based mechanisms will becollectively referred to herein as computer “models” and this term ismeant to refer to any type of machine learning computer model of varioustypes that may be subjected to gradient based attacks.

The illustrative embodiments introduce noise into the output of aprotected cognitive system that prevents an external party from beingable to reproduce the configuration and training of a cognitive system.That is, the noise obscures the actual output generated by the cognitivesystem while maintaining the correctness of the output. In this way, thecognitive system can be used to perform its operations while preventingothers from generating their own version of the trained and configuredcognitive system that would generate correct output. While an attackermay be able to assume the noisy output to be correct output for trainingtheir own cognitive system model, the attacker's model will still notgenerate the same output of the cognitive system model that the attackeris attempting to recreate. This is because even with a noisy output, thecorrect output may be one of multiple possibilities, and only the exactsame cognitive system model architecture, with the same model weights,can correctly identify which of the multiple possibilities is thecorrect one. Moreover, the illustrative embodiments provide for correctoutput of the model while preventing evasion attacks, i.e. attacks inwhich the attacker introduces noise that forces a misclassificationwithout raising suspicion, since the mechanisms of the illustrativeembodiments introduce noise to prevent gradient determinations, butprovides mechanisms for ensuring that misclassification of the output isprevented.

The success of neural network based systems has resulted in many webservices based on them. Service providers provide application programinterfaces (APIs) to end users of the web services through which the endusers may submit, via their client computing devices, input data to beprocessed by the web service, and are provided results data indicatingthe results of the operations of the web services on the input data.Many times, cognitive systems utilize the neural networks to performclassification type operations to classify input data into variousdefined categories of information. For example, in an image processingweb service, an input image comprising a plurality of data points, e.g.,pixels, may be input to the web service which operates on the inputimage data to classify elements of the input image into types of objectspresent within the image, e.g., the image comprises a person, a car, abuilding, a dog, etc., to thereby perform object or image recognition.Similar types of classification analysis may be performed for variousother types of input data including, but not limited to, speechrecognition, natural language processing, audio recognition, socialnetwork filtering, machine translation, and bioinformatics. Ofparticular interest to some illustrative embodiments described herein,such web services may provide functionality for analyzing patientinformation in patient electronic medical records (EMRs) using naturallanguage processing, analyzing medical images such as x-ray images,magnetic resonance imaging (MRI) images, computed tomography (CT) scanimages, etc., and the like.

In many cases, the service providers charge the end users a fee for theuse of the web service that is provided by the implementation of aneural network based cognitive system. However, it has been recognizedthat end users may utilize the APIs provided by the service provider tosubmit sets of input data to acquire enough output data to replicate thetraining of the neural network of the cognitive system such that the enduser is able to generate their own trained neural network and therebyavoid having to utilize the service provider's service, resulting in aloss of revenue for the service provider. That is, if the end user isutilizing the service provider's web service to label a set of inputdata based on a classification operation performed on the input data,after submitting enough input data sets, e.g., 10,000 input data sets(where the term “data set” as used herein refers to a set of one or moredata samples), and obtaining the corresponding output labels, the outputlabels may be used as a “golden” set or ground truth for traininganother neural network, e.g., the end user's own neural network, toperform a similar classification operation. This is referred to hereinas a model stealing attack in that an end user, referred to hereafter asan “attacker”, motivated to recreate the trained neural networksurreptitiously, attempts to steal the neural network model created andtrained by the service provider through utilization of the serviceprovider's APIs.

The illustrative embodiments reduce or eliminate the attacker's abilityto perform an attack using gradients or their estimations, such as modelstealing attack and evasion attack by introducing perturbations, ornoise, into the output probabilities generated by the neural network, soas to produce misleading gradient that protects against the attacker whois trying to copy or evade the neural network model. The perturbations(noise) that are introduced deviate the attacker's gradients from acorrect direction and amount and minimize loss in the accuracy of theprotected neural network model. To satisfy these two criteria, in someillustrative embodiments, two general guidelines are followed whengenerating the perturbations: (1) using the perturbation, one or moreways of learning the machine learning parameters are added to causeambiguity in the gradients, e.g., in one illustrative embodiment, thesign of the first order derivative is reversed (the first orderderivative identifies the direction, e.g., increasing/decreasing, of afunction or curve); and (2) noise is added primarily in either end ofthe function, e.g., in a softmax or sigmoid function, up to +/−0.5.

It should be appreciated that these are only example guidelines for someillustrative embodiments and many different modifications may be made tothese without departing from the spirit and scope of the presentinvention. For example, the activation functions need not be softmax orsigmoid functions, as these were chosen for the illustrative embodimentsdue to their standard use for deep learning classifiers. Any activationfunction of the protected neural network may be utilized in whichambiguity is added by way of the introduction of noise in accordancewith the illustrative embodiments.

In general, the illustrative embodiments provide various methods andmechanisms to add perturbations without negatively affecting theaccuracy of the model or neural network. For example, any noise may beadded to the activation function of the model or neural network tothereby cause ambiguity in the output that will fool a gradient-basedattacker. However, in some illustrative embodiments, the perturbationmechanisms of the illustrative embodiments add any noise that does notchange the result classification, i.e. the output of the class with thehighest probability, generate by the trained model or neural network.That is, given an output probability vector y=[y_1, . . . , y_n], theperturbation mechanisms of these illustrative embodiments may add noised such that argmax_i {y_i+d_i}=argmax_i {y_i}.

For added ambiguity in the output of the trained model or neuralnetwork, the perturbation mechanisms of the illustrative embodiments mayadd noise that causes not only the ambiguity, but also a sign change ofgradients. In such an embodiment, the perturbation mechanisms add largerperturbations to clear cases such that the probability of a class isclose to either 1 or 0 and thus, the result class of an output is likelyto be preserved. Also, by adding noise to these cases, the perturbationmechanisms add ambiguity of learning. Lastly, by the added noise, thedirection of gradients are opposite to the original gradients as theoriginal model has higher probability with clearer cases as oppose tothe perturbed output having lower probability with clearer cases.

There may be many different implementations of the perturbations thatsatisfy this criteria and all such perturbations are considered to bewithin the spirit and scope of the present invention. That is anyfunctions that generate perturbations in the output of the neuralnetwork which satisfy the above criteria and guidelines may be usedwithout departing from the spirit and scope of the present invention.

For example, assume there is a given a neural network f(x)=sigma(h(x))where sigma is a softmax or sigmoid function, h(x) is the functionrepresenting the remainder of the neural network, and x is the inputdata. Various possible perturbations satisfy the above criteria andguidelines, examples of which are as follows:

1. Copy-protect(f(x))=normalization(sigma(h(x))−0.5(sigma(0.25h(x))0.5));

2. Gaussian noise up to +/−0.5 on [h1,inf) and (−inf,−h1] where h1 isminimum h(x) such that sigma (h(x))>0.99; and

3. Random noise h′(x) such that the ranking of dimensions ofsigma(h(x)+h′(x)) is equal to sigma(h(x)).

where normalization is an identity function if sigma is the sigmoidfunction, or is a function that divides the input vector by the sum ofits values if sigma is the softmax function.

In the example perturbation 1 above, ambiguous cases are kept as-is,however the perturbation makes the output of the model or neural networkless certain if the output for the same input is more certain, up to 0.5which keeps the result class the same. That is, the higher theprobability/confidence for the original model, the lower theprobability/confidence for the protected model.

In the example perturbation 2 above, a type of random noise (which iscalled Gaussian noise) is added when the output is certain or probable,i.e. the probability of the classification is high, e.g., 1.0, 0.9, etc.depending on the implementation. The difference between perturbation 1above and perturbation 2 above is that perturbation 1 adds more noise ifthe result is more certain while perturbation 2 does not require suchordering and thus, the more certain outputs may have less noise in somecases. Perturbation 3 adds noise that does not change the relative orderof likely classes given the input data, e.g., if the input image data ismore likely to be a bird than a cow, for example, then the perturbationadds noise as long as this order is preserved.

These perturbations minimize the change in boundary case, such asf(x)=0.5, such that there is almost no change in this area, but if theprobability score is high, e.g., closer to f(x)=1.0, or low, e.g.,closer to f(x)=0.0, the perturbation is large. However, in this case,the ranking of the output classifications do not change because thechange is up to +/−0.25 for the highest ranked classification (#1), and1.0-0.25=0.75 is still the highest probability score among theclassifications. That is, if the original probability of aclassification is 1.0 and, through the introduction of noise inaccordance with illustrative embodiments set forth herein, theprobability is reduced to 0.75, then this may still be considered highand the classification of the input remains the same. However, if theprobability were to drop to 0.5, then the average user would considerthis to be uncertain, indicating that the output may not be useable andfurther analysis may be required.

Thus, the mechanisms of the illustrative embodiments improve theoperation of the neural network and the cognitive system implementingthe neural network, by adding additional non-generic functionality thatpreviously did not exist in the neural network mechanism or cognitivesystem, specifically for avoiding model stealing and/or evasion attacks.The mechanisms of the illustrative embodiments add additionaltechnological logic in the neural network and cognitive system thatspecifically implements the introduction of perturbations following thecriteria and guidelines noted above to allow for obfuscation of thetraining of the neural network, machine learning model, deep learningmodel, or the like, while maintaining the usability of the resultingoutput, e.g., the classification and labeling of the output data isstill accurate even though the actual probability values generated bythe model are not accurate to the training of the model. The mechanismsof the illustrative embodiments are specific to a technologicalenvironment involving one or more data processing systems and/orcomputing devices that are specifically configured to implement theadditional logic of the present invention thereby resulting in anon-generic technological environment comprising one or more non-genericdata processing systems and/or computing devices. Moreover, theillustrative embodiments are specifically directed to solving thetechnological problem of model stealing attacks involving thereproducing of the training of specialized computing devices havingneural network models, machine learning models, deep learning models, orother such artificial intelligence or cognitive operation basedcomputing mechanisms. Furthermore, the illustrative embodiments solvethe technological problem of model evasion attacks involving thedetermining of a right level of noise to introduce, based on adetermined gradient of the trained model, in order to cause the model tomisclassify an input.

Before beginning the discussion of the various aspects of theillustrative embodiments in more detail, it should first be appreciatedthat throughout this description the term “mechanism” will be used torefer to elements of the present invention that perform variousoperations, functions, and the like. A “mechanism,” as the term is usedherein, may be an implementation of the functions or aspects of theillustrative embodiments in the form of an apparatus, a procedure, or acomputer program product. In the case of a procedure, the procedure isimplemented by one or more devices, apparatus, computers, dataprocessing systems, or the like. In the case of a computer programproduct, the logic represented by computer code or instructions embodiedin or on the computer program product is executed by one or morehardware devices in order to implement the functionality or perform theoperations associated with the specific “mechanism.” Thus, themechanisms described herein may be implemented as specialized hardware,software executing on general purpose hardware, software instructionsstored on a medium such that the instructions are readily executable byspecialized or general purpose hardware, a procedure or method forexecuting the functions, or a combination of any of the above.

The present description and claims may make use of the terms “a”, “atleast one of”, and “one or more of” with regard to particular featuresand elements of the illustrative embodiments. It should be appreciatedthat these terms and phrases are intended to state that there is atleast one of the particular feature or element present in the particularillustrative embodiment, but that more than one can also be present.That is, these terms/phrases are not intended to limit the descriptionor claims to a single feature/element being present or require that aplurality of such features/elements be present. To the contrary, theseterms/phrases only require at least a single feature/element with thepossibility of a plurality of such features/elements being within thescope of the description and claims.

Moreover, it should be appreciated that the use of the term “engine,” ifused herein with regard to describing embodiments and features of theinvention, is not intended to be limiting of any particularimplementation for accomplishing and/or performing the actions, steps,processes, etc., attributable to and/or performed by the engine. Anengine may be software, hardware and/or firmware, or any combinationthereof, that performs the specified functions including, but notlimited to, any use of a general and/or specialized processor incombination with appropriate software loaded or stored in a machinereadable memory and executed by the processor. Further, any nameassociated with a particular engine is, unless otherwise specified, forpurposes of convenience of reference and not intended to be limiting toa specific implementation. Additionally, any functionality attributed toan engine may be equally performed by multiple engines, incorporatedinto and/or combined with the functionality of another engine of thesame or different type, or distributed across one or more engines ofvarious configurations.

In addition, it should be appreciated that the following descriptionuses a plurality of various examples for various elements of theillustrative embodiments to further illustrate example implementationsof the illustrative embodiments and to aid in the understanding of themechanisms of the illustrative embodiments. These examples intended tobe non-limiting and are not exhaustive of the various possibilities forimplementing the mechanisms of the illustrative embodiments. It will beapparent to those of ordinary skill in the art in view of the presentdescription that there are many other alternative implementations forthese various elements that may be utilized in addition to, or inreplacement of, the examples provided herein without departing from thespirit and scope of the present invention.

The present invention may be a system, a method, and/or a computerprogram product. The computer program product may include a computerreadable storage medium (or media) having computer readable programinstructions thereon for causing a processor to carry out aspects of thepresent invention.

The computer readable storage medium can be a tangible device that canretain and store instructions for use by an instruction executiondevice. The computer readable storage medium may be, for example, but isnot limited to, an electronic storage device, a magnetic storage device,an optical storage device, an electromagnetic storage device, asemiconductor storage device, or any suitable combination of theforegoing. A non-exhaustive list of more specific examples of thecomputer readable storage medium includes the following: a portablecomputer diskette, a hard disk, a random access memory (RAM), aread-only memory (ROM), an erasable programmable read-only memory (EPROMor Flash memory), a static random access memory (SRAM), a portablecompact disc read-only memory (CD-ROM), a digital versatile disk (DVD),a memory stick, a floppy disk, a mechanically encoded device such aspunch-cards or raised structures in a groove having instructionsrecorded thereon, and any suitable combination of the foregoing. Acomputer readable storage medium, as used herein, is not to be construedas being transitory signals per se, such as radio waves or other freelypropagating electromagnetic waves, electromagnetic waves propagatingthrough a waveguide or other transmission media (e.g., light pulsespassing through a fiber-optic cable), or electrical signals transmittedthrough a wire.

Computer readable program instructions described herein can bedownloaded to respective computing/processing devices from a computerreadable storage medium or to an external computer or external storagedevice via a network, for example, the Internet, a local area network, awide area network and/or a wireless network. The network may comprisecopper transmission cables, optical transmission fibers, wirelesstransmission, routers, firewalls, switches, gateway computers and/oredge servers. A network adapter card or network interface in eachcomputing/processing device receives computer readable programinstructions from the network and forwards the computer readable programinstructions for storage in a computer readable storage medium withinthe respective computing/processing device.

Computer readable program instructions for carrying out operations ofthe present invention may be assembler instructions,instruction-set-architecture (ISA) instructions, machine instructions,machine dependent instructions, microcode, firmware instructions,state-setting data, or either source code or object code written in anycombination of one or more programming languages, including an objectoriented programming language such as Java, Smalltalk, C++ or the like,and conventional procedural programming languages, such as the “C”programming language or similar programming languages. The computerreadable program instructions may execute entirely on the user'scomputer, partly on the user's computer, as a stand-alone softwarepackage, partly on the user's computer and partly on a remote computeror entirely on the remote computer or server. In the latter scenario,the remote computer may be connected to the user's computer through anytype of network, including a local area network (LAN) or a wide areanetwork (WAN), or the connection may be made to an external computer(for example, through the Internet using an Internet Service Provider).In some embodiments, electronic circuitry including, for example,programmable logic circuitry, field-programmable gate arrays (FPGA), orprogrammable logic arrays (PLA) may execute the computer readableprogram instructions by utilizing state information of the computerreadable program instructions to personalize the electronic circuitry,in order to perform aspects of the present invention.

Aspects of the present invention are described herein with reference toflowchart illustrations and/or block diagrams of methods, apparatus(systems), and computer program products according to embodiments of theinvention. It will be understood that each block of the flowchartillustrations and/or block diagrams, and combinations of blocks in theflowchart illustrations and/or block diagrams, can be implemented bycomputer readable program instructions.

These computer readable program instructions may be provided to aprocessor of a general purpose computer, special purpose computer, orother programmable data processing apparatus to produce a machine, suchthat the instructions, which execute via the processor of the computeror other programmable data processing apparatus, create means forimplementing the functions/acts specified in the flowchart and/or blockdiagram block or blocks. These computer readable program instructionsmay also be stored in a computer readable storage medium that can directa computer, a programmable data processing apparatus, and/or otherdevices to function in a particular manner, such that the computerreadable storage medium having instructions stored therein comprises anarticle of manufacture including instructions which implement aspects ofthe function/act specified in the flowchart and/or block diagram blockor blocks.

The computer readable program instructions may also be loaded onto acomputer, other programmable data processing apparatus, or other deviceto cause a series of operational steps to be performed on the computer,other programmable apparatus or other device to produce a computerimplemented process, such that the instructions which execute on thecomputer, other programmable apparatus, or other device implement thefunctions/acts specified in the flowchart and/or block diagram block orblocks.

The flowchart and block diagrams in the figures illustrate thearchitecture, functionality, and operation of possible implementationsof systems, methods, and computer program products according to variousembodiments of the present invention. In this regard, each block in theflowchart or block diagrams may represent a module, segment, or portionof instructions, which comprises one or more executable instructions forimplementing the specified logical function(s). In some alternativeimplementations, the functions noted in the block may occur out of theorder noted in the figures. For example, two blocks shown in successionmay, in fact, be executed substantially concurrently, or the blocks maysometimes be executed in the reverse order, depending upon thefunctionality involved. It will also be noted that each block of theblock diagrams and/or flowchart illustration, and combinations of blocksin the block diagrams and/or flowchart illustration, can be implementedby special purpose hardware-based systems that perform the specifiedfunctions or acts or carry out combinations of special purpose hardwareand computer instructions.

As noted above, the present invention provides mechanisms for protectingcognitive systems, such as those comprising neural networks and/or deeplearning mechanisms, from attacks using gradients or their estimationssuch as model stealing or model evasion. FIGS. 1A-1D are block diagramsillustrating problems addressed by the present invention and thesolution offered by the mechanisms of the illustrative embodiments. Inthe depictions of FIGS. 1A-1D it is assumed that the neural networkmodel has been trained using training data, such as through a supervisedor semi-supervised process using a ground truth data structure or thelike, or any other known or later developed methodology for training aneural network model. FIGS. 1A and 1B depict block diagrams illustratingthe problem of model stealing attacks and the solution of theperturbation insertion engine 160 provided by the mechanisms of theillustrative embodiments. FIGS. 1C and 1D depict block diagramsillustrating the problem of model evasion attacks and the solution ofthe perturbation insertion engine 160 provided by the mechanisms of theillustrative embodiments.

The examples shown in FIGS. 1A-1D assume that the neural network modelis being used to perform a classification operation on an image of anumber to thereby classify the image of the number as a number from “0”to “9”. This is used only as an example of one possible simpleclassification operation that the neural network model may be used toperform and is not to be considered limiting on the applications of aneural network model with which the mechanisms of the illustrativeembodiments may be implemented. As noted above, the mechanisms of theillustrative embodiments may be utilized with the outputs of any neuralnetwork models, machine learning models, or the like, regardless of theparticular artificial intelligence operations performed by the neuralnetwork models, machine learning models, or the like. Moreover, althoughnot shown explicitly in FIGS. 1A-1D, the neural network model, machinelearning model, deep learning model, or the like, may be part of a morecomplex cognitive system that implements such a model to perform acomplex cognitive operation, such as natural language processing, imageanalysis, patient treatment recommendation, medical imaging analysis, orany of a plethora of other cognitive operations, as described hereafter.

As shown in FIG. 1A, for a model stealing attacks, an attacker 110 maysubmit one or more sets of input data 120 to a trained neural networkmodel 130 to obtain a labeled data set 140 that is output as result datato the attacker 110. Again, it should be appreciated that the term “dataset” as used herein refers to a set of data that may comprise one or aplurality of data samples. In the case that a data set comprises morethan one data sample, these data samples may be input to the trainedneural network model 130 as a batch.

This process may be repeated for a plurality of sets of input data 120to generate a plurality of labeled data sets 140 (which may alsocomprise labels for one or more data samples). A labeled data set 140 isa set of output data generated by the trained neural network model 130where the unlabeled input data is augmented with additional tags orlabels of meaningful information for the particular cognitive operationfor which the data is to be used. For example, in a patient treatmentrecommendation cognitive system, the labeled data may comprise labels,tags, or annotations that specify various medical concepts with whichthe data is associated, e.g., a disease, a treatment, a patient's age, apatient's gender, etc. In the depicted example, the operation of theneural network model 130 is to classify a portion of an input imagespecified in a set of input data 120 into one of 10 categoriesrepresenting numerical values that the portion of the input imagerepresents, e.g., classes “0” to “9”. Thus, the label that is affixed toa set of input data 120 may be a label of “0” or “1” or “2”, etc.

The attacker 110, having obtained a plurality of labeled data sets 140based on a plurality of input data sets 120 may utilize thiscorrespondence of inputs/outputs to train their own model 150 toreplicate the trained neural network model 130. Once the attacker 110has their own replicated version 150 of the trained neural network model130, they no longer need to utilize the original trained neural networkmodel 130 to obtain the labeled data set 140 for future input data sets120 and can utilize their own replicated model 150. This causes theprovider of the original trained neural network model 130 to loserevenue from fees that may be charged for the use of original trainedneural network model 130. In addition, this may give rise to competitorsto the service provider that surreptitiously obtain the benefit of theresource investment of the service provider with regard to training theneural network model 130, without actually having to make such aresource investment.

As shown in FIG. 1A, the trained neural network 130 performs aclassification operation for classifying the input data set 120. Theoutput of the classification operation is a vector 135 of probabilityvalues where each slot of the vector output 135 represents a separatepossible classification of the input data set 120. The training of aneural network, machine learning, deep learning, or other artificialintelligence model is generally known in the art and it is assumed thatany such methodology may be used to perform such training. The traininggenerally involves modifying weighting values associated with variousfeatures scored by nodes of the model based on training data sets tocause the model to output a correct vector output 135 labeling the inputdata set 120 correctly based on supervised or semi-supervised feedback.The neural network model 130 processes the input data set 120 throughthe various levels of nodes in the neural network model 130 to generateat the output nodes probability values corresponding to the particularclass or label that the output node represents, i.e. the output node'svalue indicates the probability that the class or label of thecorresponding vector slot applies to the input data set 120.

In this depicted example, each slot of the vector output 135 correspondsto a possible classification from “0” to “9” indicating the possiblenumerical values that the portion of the input image may represent. Theprobability values may range from 0% (e.g., 0.0) to 100% (e.g., 1.0) andmay have various levels of precision based on the particularimplementation desired. Thus, if a label or classification of “1” has aprobability value of 1.0 this indicates absolute confidence that theinput data set 120 represents the numerical value of “1” and aprobability of value of 0.0 indicates that the input data set 120 doesnot represent the corresponding value, i.e. the label of that vectorslot does not apply to the input data set 120.

While this is a simple example used for illustrative purposes, it shouldbe appreciated that the number of classifications and correspondinglabels, as well as the corresponding vector output 135, may be quitecomplex. As another example, these classifications may be, for example,in a medical imaging application where internal structures of humananatomy are being classified in a patient's chest, e.g., an aorta, aheart valve, a left ventricle, right ventricle, lungs, etc. It should beappreciated that the vector output 135 may comprise any number ofpotential vector slots, or classifications, at various levels ofgranularity depending on the particular application and implementation,and the vector output 135 may be of various sizes correspondingly.

A highest probability value vector slot (or simply “slot”) in the vectoroutput 135 may be selected to label the corresponding input data set120. Thus, for example, assuming that the trained neural network model130 is properly trained, an input data set 120 having an image of anumerical value of “2” will have an output vector 135 similar to thatshown in FIG. 1A where the slot of the output vector 135 has acorresponding probability value that is a highest probability value ofthose in all of the slots of the vector output 135, e.g., “0.9” in thisexample. Thus, the labeled data output 140 would include a labeled dataset that has a label of “2” associated with the input data set 120showing the portion of an image corresponding to the numerical value“2.”

FIG. 1B provides a block diagram illustrating an overview of themechanism of one illustrative embodiment used to avoid model stealingattacks. The diagram shown in FIG. 1B is similar to that of FIG. 1Aexcept that a perturbation insertion engine 160 is provided inassociation with, or as part of, the trained neural network model 130.For example, in embodiments where the perturbation insertion engine 160is provided as part of the model 130 itself, the perturbation insertionengine 160 may operate as an additional layer of the model 130 justprior to the output layer of the model to thereby introduceperturbations in the probability values generated at the layer of thetrained neural network model 130 just prior to the output layer of themodel 130. In embodiments where the perturbation insertion engine 160 isexternal to the model 130, the perturbations may be injected into theoutput vector 135 of the trained neural network model 130 to therebymodify the original vector output 135 that is generated by the trainedneural network model 130 to be a modified vector output 165 prior togenerating the labeled data set 140 that is output to the attacker 110.

As shown in FIG. 1B, the modified vector output 165 provides a modifiedset of probability values associated with different labels or classescorresponding to vector slots. These modified probability values aregenerated by the introduction of the perturbations, or noise, into theprobability values calculated from the trained neural network model 130.Thus, in this example, rather than the correct classification of “2”having a probability value of “0.9” indicating overwhelmingly that thelabel “2” is the correct label, the vector output 165 indicates that theprobability value is “0.6” with the label “3” now having a probabilityvalue of “0.4”. While the result is still the same label of “2” beingapplied to the input data set, the probability values are different thanthe trained neural network would normally generate. Thus, if theattacker 110 were to utilize the modified probability values of themodified vector output 165 to train their own neural network model, theresulting training would not replicate the trained neural network model130 as incorrect probability values would be utilized.

The introduction of the perturbations, or noise, into the output of thetrained neural network model 130 results in a modified or manipulatedlabeled data set 170 that is provided to the attacker 110 rather thanthe actual labeled data set 140 that would otherwise have been generatedby the operation of the trained neural network model 130. If theattacker uses the manipulated labeled data set 170 to train theattackers own neural network model 150, the result will be anill-replicated model with lower performance.

As mentioned previously, in addition to protecting against modelstealing attacks such as that described above with regard to FIGS.1A-1B, the illustrative embodiments further provide protections againstmodel evasion attacks, as depicted in FIGS. 1C-1D. As shown in FIG. 1C,in a model evasion attack, the attacker 110 attempts to compute thegradient 172 of the trained model 130 based on the outputs 135 using agradient computation tool 170. Such gradient computations as part ofmodel evasion attacks are generally known in the art. Based on thecomputed gradient 172, the attacker 110 determines a level of noise thatcan be introduced into the data 120 to cause the model 130 tomisclassify the data 120 and generate incorrectly labeled data 140, i.e.misclassified data 140. Thus, noisy data 176 is generated by modifyingthe input data 120 with the introduction of misclassification noise 174which causes the model 130 to misclassify the input data into adifferent class than it would otherwise be classified, e.g., instead ofdata 120 which represents an image of a stop sign being classified intoa class of “stop sign”, the noisy version of the input data 120, i.e.data 176, will cause the input data 120 to be misclassified into adifferent class, e.g., “speed limit sign”. The amount of noiseintroduced is such that the model 130 misclassifies the input data 120but is not significant enough to cause the attack to be detected.

As shown in FIG. 1D, the perturbation insertion engine 160 operates in asimilar manner as previously described above but so as to modify thegradient such that the gradient computation tool 170 of the attacker isnot able to correctly identify the gradient of the model 130. Thus,instead of the gradient computation tool 170 generating the correctgradient 172, an incorrect gradient 180 is determined based on theoutputs 135 which are generated based on the perturbations introducedinto the gradient of the model 130. Hence, an incorrectmisclassification noise 183 will be generated by the attacker 110 whichwill not cause misclassification by the model 130. That is, the noisydata 184, while having misclassification noise 182 introduced into it,will still not be significant enough to cause the model 130 toincorrectly classify the data 120. Thus, the model 130 will still outputcorrect labeled (classified) data 140.

To illustrate the way in which the introduction of perturbations ornoise into the output generated by the trained neural network modeloperates to obfuscate the training of the neural network model, considerthe example diagrams in FIGS. 2A and 2B. FIG. 2A illustrates the sigmoidfunction that is typically used with neural network models. As shown inFIG. 2A, probability values follow the sigmoid function curve in apredictable manner. That is, as a data sample of the input data set isprocessed through multiple layers of the neural network model, the datasample's features (e.g., shapes or layouts of black pixels) areaggregated to produce a “score”. This score is highly relevant to theoutput probability, but is not normalized. In some illustrativeembodiments, the score is a probability that ranges from 0.0 to 1.0, butthis score can be an arbitrary value. The sigmoid or softmax function isa function to normalize such a score into a [0,1] boundary. The sigmoidfunction looks at a single score (e.g., label “2” score is 100, then theprobability becomes 0.9), and softmax considers multiple competingscores, e.g., label “2” score is 100, and label “3” score is 300) inwhich case the label “2” probability is 0.2, and the label “3”probability is 0.8. The sigmoid function is only used in binaryclassification where there only two distinct classes. The softmaxfunction is a generalization of the sigmoid function to more classes andthus, it shares many similarities to sigmoid.

The sigmoid or softmax function can be considered to be stretched orshrunk depending on the training of the neural network model by updatingthe model weights, but is predictable to an attacker 110 given a labeleddata set 140, for example, through curve fitting or the like, i.e. theattacker attempts to learn the same curve used by the trained neuralnetwork model 130 based on the collection of input data sets 120 andcorresponding output labeled data 140 obtained from the trained neuralnetwork model 130. Typically, such learning of the curve requires thecalculation of a gradient (e.g., change in y coordinate divided bychange in x coordinate of a graphed curve) from points along the curveto know the direction and magnitude of the curvature of the curve.

With reference now to FIG. 2B, in accordance with the mechanisms of theillustrative embodiments, perturbations, or noise, are introduced intothe curve such that the correct gradient of the curve is not able to beidentified by the attacker 110. As shown in FIG. 2B, at portions of thecurve where perturbations are introduced, the attacker 110 is fooled bythe perturbation in identifying an incorrect location of the point alongthe curve, e.g., the attacker 110 can be fooled into identifying thelocation P1 as being at location P2 due to the perturbation 200introduced into the curve, as the attacker relies on the probabilityscore (y-axis) to find the location. That is, without perturbation, theattacker can infer the correct position (x-axis value) given theprobability (y-axis value). However, with this perturbation, there aremore than one position with the given probability. As a result, theattacker cannot precisely determine to which position to fit thereplicated curve. Moreover, depending on the type of perturbation, asshown in FIG. 2B, the gradients computed by the attacker to train areplicated model (model stealing attack), or to determinemisclassification noise to introduce (evasion attack), can be theopposite direction of the genuine one, which can revert at least a partof the training and replication process.

Because of the nature of the softmax or sigmoid function curve, there ismore area of the curve into which perturbations or noise may be added atthe ends of the curve. Thus, the mechanisms of some illustrativeembodiments utilize perturbation injection logic that introduce suchperturbations in the ends of the curve near 0.0 and 1.0, i.e. very lowand very high probability value areas as previously mentioned above, soas to make an attacker's attempt to utilize the output of the trainedneural network model 130 to train their own neural network model resultin a lower performance model. The introduction of the perturbations ornoise at the ends of the curve can be facilitated by subtracting asigmoid function or hyperbolic tangent function that has a higherabsolute value in the ends of the curve, like 0.5(sigma(0.25h(x))−0.5))in perturbation 1 mentioned above.

Thus, the illustrative embodiments provide mechanisms for obfuscating atrained configuration of a neural network, machine learning, deeplearning, of other artificial intelligence/cognitive model byintroducing noise into the output of such trained models in such a wayas to maintain the accuracy of the output, yet manipulate the outputvalues to make detection of the specific curve or function to which themodel correlates difficult to reproduce. The introduction of theperturbations, or noise, is done so as to minimize the change inboundary cases but introduce large size perturbations in areas of thecurve or function where the probability values are relatively high/low,e.g., near 1.0 and near 0.0 in the case of a sigmoid/softmax function.While such perturbations are introduced into these areas of the functionor curve, the perturbations are sized such that that output classes donot change in the modified output because the perturbation modificationsare limited to less than predetermined amount of change that will notmodify the output classifications.

As noted above, the mechanisms of the illustrative embodiments aredirected to protecting trained neural network models, machine learningmodels, deep learning models, and the like, implemented in specializedlogic of specially configured computing devices, data processingsystems, or the like, of a technological environment. As such, theillustrative embodiments may be utilized in many different types of dataprocessing environments. In order to provide a context for thedescription of the specific elements and functionality of theillustrative embodiments, FIGS. 3-5 are provided hereafter as exampleenvironments in which aspects of the illustrative embodiments may beimplemented. It should be appreciated that FIGS. 3-5 are only examplesand are not intended to assert or imply any limitation with regard tothe environments in which aspects or embodiments of the presentinvention may be implemented. Many modifications to the depictedenvironments may be made without departing from the spirit and scope ofthe present invention.

FIGS. 3-5 are directed to describing an example cognitive system whichimplements a request processing pipeline, such as a Question Answering(QA) pipeline (also referred to as a Question/Answer pipeline orQuestion and Answer pipeline) for example, request processingmethodology, and request processing computer program product with whichthe mechanisms of the illustrative embodiments are implemented. Theserequests may be provided as structured or unstructured request messages,natural language questions, or any other suitable format for requestingan operation to be performed by the cognitive system. In someillustrative embodiments, the requests may be in the form of input datasets that are to be classified in accordance with a cognitiveclassification operation performed by a machine learning, neuralnetwork, deep learning, or other artificial intelligence based modelthat is implemented by the cognitive system. The input data sets mayrepresent various types of input data depending upon the particularimplementation, such as audio input data, image input data, textualinput data, or the like. For example, in one possible implementation,the input data set may represent a medical image, such as an x-rayimage, CT scan image, MRI image, or the like, that is to have portionsof the image, or the image as a whole, classified into one or morepredefined classifications.

It should be appreciated that classification of input data may result ina labeled set of data that has labels or annotations representing thecorresponding classes into which the non-labeled input data set isclassified. This may be an intermediate step in performing othercognitive operations by the cognitive system that support decisionmaking by human users, e.g., the cognitive system may be a decisionsupport system. For example, in a medical domain, the cognitive systemmay operate to perform medical image analysis to identify anomalies foridentification to a clinician, patient diagnosis and/or treatmentrecommendation, drug interaction analysis, or any of a plethora of otherpossible decision support operations.

It should be appreciated that the cognitive system, while shown ashaving a single request processing pipeline in the examples hereafter,may in fact have multiple request processing pipelines. Each requestprocessing pipeline may be separately trained and/or configured toprocess requests associated with different domains or be configured toperform the same or different analysis on input requests (or questionsin implementations using a QA pipeline), depending on the desiredimplementation. For example, in some cases, a first request processingpipeline may be trained to operate on input requests directed to amedical image analysis, while a second request processing pipeline maybe configured and trained to operate on input requests concerningpatient electronic medical record (EMR) analysis involving naturallanguage processing. In other cases, for example, the request processingpipelines may be configured to provide different types of cognitivefunctions or support different types of applications, such as onerequest processing pipeline being used for patient treatmentrecommendation generation, while another pipeline may be trained forfinancial industry based forecasting, etc.

Moreover, each request processing pipeline may have their own associatedcorpus or corpora that they ingest and operate on, e.g., one corpus formedical treatment documents and another corpus for financial industrydomain related documents in the above examples. In some cases, therequest processing pipelines may each operate on the same domain ofinput questions but may have different configurations, e.g., differentannotators or differently trained annotators, such that differentanalysis and potential answers are generated. The cognitive system mayprovide additional logic for routing input questions to the appropriaterequest processing pipeline, such as based on a determined domain of theinput request, combining and evaluating final results generated by theprocessing performed by multiple request processing pipelines, and othercontrol and interaction logic that facilitates the utilization ofmultiple request processing pipelines.

As noted above, one type of request processing pipeline with which themechanisms of the illustrative embodiments may be utilized is a QuestionAnswering (QA) pipeline. The description of example embodiments of thepresent invention hereafter will utilize a QA pipeline as an example ofa request processing pipeline that may be augmented to includemechanisms in accordance with one or more illustrative embodiments. Itshould be appreciated that while the present invention will be describedin the context of the cognitive system implementing one or more QApipelines that operate on an input question, the illustrativeembodiments are not limited to such. Rather, the mechanisms of theillustrative embodiments may operate on requests that are not posed as“questions” but are formatted as requests for the cognitive system toperform cognitive operations on a specified set of input data using theassociated corpus or corpora and the specific configuration informationused to configure the cognitive system. For example, rather than askinga natural language question of “What diagnosis applies to patient P?”,the cognitive system may instead receive a request of “generatediagnosis for patient P,” or the like. It should be appreciated that themechanisms of the QA system pipeline may operate on requests in asimilar manner to that of input natural language questions with minormodifications. In fact, in some cases, a request may be converted to anatural language question for processing by the QA system pipelines ifdesired for the particular implementation.

As will be discussed in greater detail hereafter, the illustrativeembodiments may be integrated in, augment, and extend the functionalityof these QA pipeline, or request processing pipeline, mechanisms toprotect the models implemented in these pipelines, or by the cognitivesystem as a whole, from model stealing attacks. In particular, inportions of the cognitive system in which the trained neural networkmodels, machine learning models, deep learning models, or the like, areemployed to generate labeled data set outputs, the mechanisms of theillustrative embodiments may be implemented to modify the labeled dataset outputs by the introduction of noise into the probability valuesgenerated by the trained models and thereby obfuscate the training ofthe models.

As the mechanisms of the illustrative embodiments may be part of acognitive system and may improve the operation of the cognitive systemby protecting it from model stealing attacks, it is important to firsthave an understanding of how cognitive systems and question and answercreation in a cognitive system implementing a QA pipeline is implementedbefore describing how the mechanisms of the illustrative embodiments areintegrated in and augment such cognitive systems and request processingpipeline, or QA pipeline, mechanisms. It should be appreciated that themechanisms described in FIGS. 3-5 are only examples and are not intendedto state or imply any limitation with regard to the type of cognitivesystem mechanisms with which the illustrative embodiments areimplemented. Many modifications to the example cognitive system shown inFIGS. 3-5 may be implemented in various embodiments of the presentinvention without departing from the spirit and scope of the presentinvention.

As an overview, a cognitive system is a specialized computer system, orset of computer systems, configured with hardware and/or software logic(in combination with hardware logic upon which the software executes) toemulate human cognitive functions. These cognitive systems applyhuman-like characteristics to conveying and manipulating ideas which,when combined with the inherent strengths of digital computing, cansolve problems with high accuracy and resilience on a large scale. Acognitive system performs one or more computer-implemented cognitiveoperations that approximate a human thought process as well as enablepeople and machines to interact in a more natural manner so as to extendand magnify human expertise and cognition. A cognitive system comprisesartificial intelligence logic, such as natural language processing (NLP)based logic, for example, and machine learning logic, which may beprovided as specialized hardware, software executed on hardware, or anycombination of specialized hardware and software executed on hardware.This logic may implement one or more models, such as a neural networkmodel, a machine learning model, a deep learning model, that may betrained for particular purposes for supporting the particular cognitiveoperations performed by the cognitive system. In accordance with themechanisms of the illustrative embodiments, the logic further implementsthe perturbation insertion engine mechanisms described above, andhereafter, for introducing perturbations, or noise, into the outputs ofthe implemented models so as to obfuscate the training of the models tothose who would attempt to perform model stealing attacks.

The logic of the cognitive system implements the cognitive computingoperation(s), examples of which include, but are not limited to,question answering, identification of related concepts within differentportions of content in a corpus, intelligent search algorithms, such asInternet web page searches, for example, medical diagnostic andtreatment recommendations, other types of recommendation generation,e.g., items of interest to a particular user, potential new contactrecommendations, etc., image analysis, audio analysis, and the like. Thetypes and number of cognitive operations that may be implemented usingthe cognitive system of the illustrative embodiments are vast and cannotall be documented herein. Any cognitive computing operation emulatingdecision making and analysis performed by human beings, but in anartificial intelligence or cognitive computing manner, is intended to bewithin the spirit and scope of the present invention.

IBM Watson™ is an example of one such cognitive computing system whichcan process human readable language and identify inferences between textpassages with human-like high accuracy at speeds far faster than humanbeings and on a larger scale. In general, such cognitive systems areable to perform the following functions:

-   -   Navigate the complexities of human language and understanding    -   Ingest and process vast amounts of structured and unstructured        data    -   Generate and evaluate hypothesis    -   Weigh and evaluate responses that are based only on relevant        evidence    -   Provide situation-specific advice, insights, and guidance    -   Improve knowledge and learn with each iteration and interaction        through machine learning processes    -   Enable decision making at the point of impact (contextual        guidance)    -   Scale in proportion to the task    -   Extend and magnify human expertise and cognition    -   Identify resonating, human-like attributes and traits from        natural language    -   Deduce various language specific or agnostic attributes from        natural language    -   High degree of relevant recollection from data points (images,        text, voice) (memorization and recall)    -   Predict and sense with situational awareness that mimic human        cognition based on experiences    -   Answer questions based on natural language and specific evidence

In one aspect, cognitive computing systems (or simply “cognitivesystems”) provide mechanisms for answering questions posed to thesecognitive systems using a Question Answering pipeline or system (QAsystem) and/or process requests which may or may not be posed as naturallanguage questions. The QA pipeline or system is an artificialintelligence application executing on data processing hardware thatanswers questions pertaining to a given subject-matter domain presentedin natural language. The QA pipeline receives inputs from varioussources including input over a network, a corpus of electronic documentsor other data, data from a content creator, information from one or morecontent users, and other such inputs from other possible sources ofinput. Data storage devices store the corpus of data. A content creatorcreates content in a document for use as part of a corpus of data withthe QA pipeline. The document may include any file, text, article, orsource of data for use in the QA system. For example, a QA pipelineaccesses a body of knowledge about the domain, or subject matter area,e.g., financial domain, medical domain, legal domain, etc., where thebody of knowledge (knowledgebase) can be organized in a variety ofconfigurations, e.g., a structured repository of domain-specificinformation, such as ontologies, or unstructured data related to thedomain, or a collection of natural language documents about the domain.

Content users input questions to cognitive system which implements theQA pipeline. The QA pipeline then answers the input questions using thecontent in the corpus of data by evaluating documents, sections ofdocuments, portions of data in the corpus, or the like. When a processevaluates a given section of a document for semantic content, theprocess can use a variety of conventions to query such document from theQA pipeline, e.g., sending the query to the QA pipeline as a well-formedquestion which is then interpreted by the QA pipeline and a response isprovided containing one or more answers to the question. Semanticcontent is content based on the relation between signifiers, such aswords, phrases, signs, and symbols, and what they stand for, theirdenotation, or connotation. In other words, semantic content is contentthat interprets an expression, such as by using Natural LanguageProcessing.

As will be described in greater detail hereafter, the QA pipelinereceives an input question, parses the question to extract the majorfeatures of the question, uses the extracted features to formulatequeries, and then applies those queries to the corpus of data. Based onthe application of the queries to the corpus of data, the QA pipelinegenerates a set of hypotheses, or candidate answers to the inputquestion, by looking across the corpus of data for portions of thecorpus of data that have some potential for containing a valuableresponse to the input question. The QA pipeline then performs deepanalysis on the language of the input question and the language used ineach of the portions of the corpus of data found during the applicationof the queries using a variety of reasoning algorithms. There may behundreds or even thousands of reasoning algorithms applied, each ofwhich performs different analysis, e.g., comparisons, natural languageanalysis, lexical analysis, or the like, and generates a score. Forexample, some reasoning algorithms may look at the matching of terms andsynonyms within the language of the input question and the foundportions of the corpus of data. Other reasoning algorithms may look attemporal or spatial features in the language, while others may evaluatethe source of the portion of the corpus of data and evaluate itsveracity.

The scores obtained from the various reasoning algorithms indicate theextent to which the potential response is inferred by the input questionbased on the specific area of focus of that reasoning algorithm. Eachresulting score is then weighted against a statistical model. Thestatistical model captures how well the reasoning algorithm performed atestablishing the inference between two similar passages for a particulardomain during the training period of the QA pipeline. The statisticalmodel is used to summarize a level of confidence that the QA pipelinehas regarding the evidence that the potential response, i.e. candidateanswer, is inferred by the question. This process is repeated for eachof the candidate answers until the QA pipeline identifies candidateanswers that surface as being significantly stronger than others andthus, generates a final answer, or ranked set of answers, for the inputquestion.

As mentioned above, QA pipeline mechanisms operate by accessinginformation from a corpus of data or information (also referred to as acorpus of content), analyzing it, and then generating answer resultsbased on the analysis of this data. Accessing information from a corpusof data typically includes: a database query that answers questionsabout what is in a collection of structured records, and a search thatdelivers a collection of document links in response to a query against acollection of unstructured data (text, markup language, etc.).Conventional question answering systems are capable of generatinganswers based on the corpus of data and the input question, verifyinganswers to a collection of questions for the corpus of data, correctingerrors in digital text using a corpus of data, and selecting answers toquestions from a pool of potential answers, i.e. candidate answers.

Content creators, such as article authors, electronic document creators,web page authors, document database creators, and the like, determineuse cases for products, solutions, and services described in suchcontent before writing their content. Consequently, the content creatorsknow what questions the content is intended to answer in a particulartopic addressed by the content. Categorizing the questions, such as interms of roles, type of information, tasks, or the like, associated withthe question, in each document of a corpus of data allows the QApipeline to more quickly and efficiently identify documents containingcontent related to a specific query. The content may also answer otherquestions that the content creator did not contemplate that may beuseful to content users. The questions and answers may be verified bythe content creator to be contained in the content for a given document.These capabilities contribute to improved accuracy, system performance,machine learning, and confidence of the QA pipeline. Content creators,automated tools, or the like, annotate or otherwise generate metadatafor providing information useable by the QA pipeline to identify thesequestion and answer attributes of the content.

Operating on such content, the QA pipeline generates answers for inputquestions using a plurality of intensive analysis mechanisms whichevaluate the content to identify the most probable answers, i.e.candidate answers, for the input question. The most probable answers areoutput as a ranked listing of candidate answers ranked according totheir relative scores or confidence measures calculated duringevaluation of the candidate answers, as a single final answer having ahighest ranking score or confidence measure, or which is a best match tothe input question, or a combination of ranked listing and final answer.

FIG. 3 depicts a schematic diagram of one illustrative embodiment of acognitive system 300 implementing a request processing pipeline 308,which in some embodiments may be a question answering (QA) pipeline, ina computer network 302. For purposes of the present description, it willbe assumed that the request processing pipeline 308 is implemented as aQA pipeline that operates on structured and/or unstructured requests inthe form of input questions. One example of a question processingoperation which may be used in conjunction with the principles describedherein is described in U.S. Patent Application Publication No.2011/0125734, which is herein incorporated by reference in its entirety.The cognitive system 300 is implemented on one or more computing devices304A-D (comprising one or more processors and one or more memories, andpotentially any other computing device elements generally known in theart including buses, storage devices, communication interfaces, and thelike) connected to the computer network 302. For purposes ofillustration only, FIG. 3 depicts the cognitive system 300 beingimplemented on computing device 304A only, but as noted above thecognitive system 300 may be distributed across multiple computingdevices, such as a plurality of computing devices 304A-D. The network302 includes multiple computing devices 304A-D, which may operate asserver computing devices, and 310-312 which may operate as clientcomputing devices, in communication with each other and with otherdevices or components via one or more wired and/or wireless datacommunication links, where each communication link comprises one or moreof wires, routers, switches, transmitters, receivers, or the like. Insome illustrative embodiments, the cognitive system 300 and network 302enables question processing and answer generation (QA) functionality forone or more cognitive system users via their respective computingdevices 310-312. In other embodiments, the cognitive system 300 andnetwork 302 may provide other types of cognitive operations including,but not limited to, request processing and cognitive response generationwhich may take many different forms depending upon the desiredimplementation, e.g., cognitive information retrieval,training/instruction of users, cognitive evaluation of data, or thelike. Other embodiments of the cognitive system 300 may be used withcomponents, systems, sub-systems, and/or devices other than those thatare depicted herein.

The cognitive system 300 is configured to implement a request processingpipeline 308 that receive inputs from various sources. The requests maybe posed in the form of a natural language question, natural languagerequest for information, natural language request for the performance ofa cognitive operation, or the like. For example, the cognitive system300 receives input from the network 302, a corpus or corpora ofelectronic documents 306, cognitive system users, and/or other data andother possible sources of input. In one embodiment, some or all of theinputs to the cognitive system 300 are routed through the network 302.The various computing devices 304A-D on the network 302 include accesspoints for content creators and cognitive system users. Some of thecomputing devices 304A-D include devices for a database storing thecorpus or corpora of data 306 (which is shown as a separate entity inFIG. 3 for illustrative purposes only). Portions of the corpus orcorpora of data 306 may also be provided on one or more other networkattached storage devices, in one or more databases, or other computingdevices not explicitly shown in FIG. 3. The network 302 includes localnetwork connections and remote connections in various embodiments, suchthat the cognitive system 300 may operate in environments of any size,including local and global, e.g., the Internet.

In one embodiment, the content creator creates content in a document ofthe corpus or corpora of data 306 for use as part of a corpus of datawith the cognitive system 300. The document includes any file, text,article, or source of data for use in the cognitive system 300.Cognitive system users access the cognitive system 300 via a networkconnection or an Internet connection to the network 302, and inputquestions/requests to the cognitive system 300 that areanswered/processed based on the content in the corpus or corpora of data306. In one embodiment, the questions/requests are formed using naturallanguage. The cognitive system 300 parses and interprets thequestion/request via a pipeline 308, and provides a response to thecognitive system user, e.g., cognitive system user 310, containing oneor more answers to the question posed, response to the request, resultsof processing the request, or the like. In some embodiments, thecognitive system 300 provides a response to users in a ranked list ofcandidate answers/responses while in other illustrative embodiments, thecognitive system 300 provides a single final answer/response or acombination of a final answer/response and ranked listing of othercandidate answers/responses.

The cognitive system 300 implements the pipeline 308 which comprises aplurality of stages for processing an input question/request based oninformation obtained from the corpus or corpora of data 306. Thepipeline 308 generates answers/responses for the input question orrequest based on the processing of the input question/request and thecorpus or corpora of data 306. The pipeline 308 will be described ingreater detail hereafter with regard to FIG. 5.

In some illustrative embodiments, the cognitive system 300 may be theIBM Watson™ cognitive system available from International BusinessMachines Corporation of Armonk, N.Y., which is augmented with themechanisms of the illustrative embodiments described hereafter. Asoutlined previously, a pipeline of the IBM Watson™ cognitive systemreceives an input question or request which it then parses to extractthe major features of the question/request, which in turn are then usedto formulate queries that are applied to the corpus or corpora of data306. Based on the application of the queries to the corpus or corpora ofdata 306, a set of hypotheses, or candidate answers/responses to theinput question/request, are generated by looking across the corpus orcorpora of data 306 for portions of the corpus or corpora of data 306(hereafter referred to simply as the corpus 306) that have somepotential for containing a valuable response to the inputquestion/response (hereafter assumed to be an input question). Thepipeline 308 of the IBM Watson™ cognitive system then performs deepanalysis on the language of the input question and the language used ineach of the portions of the corpus 306 found during the application ofthe queries using a variety of reasoning algorithms.

The scores obtained from the various reasoning algorithms are thenweighted against a statistical model that summarizes a level ofconfidence that the pipeline 308 of the IBM Watson™ cognitive system300, in this example, has regarding the evidence that the potentialcandidate answer is inferred by the question. This process is berepeated for each of the candidate answers to generate ranked listing ofcandidate answers which may then be presented to the user that submittedthe input question, e.g., a user of client computing device 310, or fromwhich a final answer is selected and presented to the user. Moreinformation about the pipeline 308 of the IBM Watson™ cognitive system300 may be obtained, for example, from the IBM Corporation website, IBMRedbooks, and the like. For example, information about the pipeline ofthe IBM Watson™ cognitive system can be found in Yuan et al., “Watsonand Healthcare,” IBM developerWorks, 2011 and “The Era of CognitiveSystems: An Inside Look at IBM Watson and How it Works” by Rob High, IBMRedbooks, 2012.

As noted above, while the input to the cognitive system 300 from aclient device may be posed in the form of a natural language question,the illustrative embodiments are not limited to such. Rather, the inputquestion may in fact be formatted or structured as any suitable type ofrequest which may be parsed and analyzed using structured and/orunstructured input analysis, including but not limited to the naturallanguage parsing and analysis mechanisms of a cognitive system such asIBM Watson™, to determine the basis upon which to perform cognitiveanalysis and providing a result of the cognitive analysis.

Regardless of the manner by which the question or request is input tothe cognitive system 300, the processing of the request or questioninvolves the application of a trained model, e.g., neural network model,machine learning model, deep learning model, etc., to an input data setas described previously above. This input data set may representfeatures of the actual request or question itself, data submitted alongwith the request or question upon which processing is to be performed,or the like. The application of the trained model to an input data setmay occur at various points during the performance of the cognitivecomputing operations by the cognitive system. For example, the trainedmodel may be utilized during feature extraction and classification by afeature extraction stage of processing of the request or input question,e.g., taking a natural language term in the request or question andclassifying it as one of a plurality of possible concepts that the termcorresponds to, e.g., classifying the term “truck” in an input questionor request into a plurality of possible classes, one of which may be“vehicle”. As another example, a portion of an image comprising aplurality of pixel data may have the trained model applied to it todetermine what the object is that is in the portion of the image. Themechanisms of the illustrative embodiments operate on the output of thetrained model as discussed previously above, which may be anintermediate operation within the overall cognitive system's cognitivecomputing operations, e.g., classification of a portion of a medicalimage into one of a plurality of different anatomical structures may bean intermediate operation to performing an anomaly identification andtreatment recommendation cognitive computing operation.

As shown in FIG. 3, the cognitive system 300 is further augmented, inaccordance with the mechanisms of the illustrative embodiments, toinclude logic implemented in specialized hardware, software executed onhardware, or any combination of specialized hardware and softwareexecuted on hardware, for implementing a perturbation insertion engine320. The perturbation insertion engine 320 may be provided as anexternal engine to the logic implementing the trained model 360 of thecognitive system 300 or may be integrated into the trained model logic360, such as in a layer of the model prior to the output of a vectoroutput of probability values representing the classification of theinput data and its corresponding labels. The perturbation insertionengine 320 operates to insert perturbations into the outputprobabilities generated by the trained model logic 360 such thatgradients calculated for points along a curve represented by the outputprobabilities deviate from a correct direction and amount and alsominimize accuracy loss in the modified output classifications andcorresponding labels.

In one illustrative embodiment, the perturbation insertion engine 320meets these criteria by using a perturbation function that reverses thesign of the first order derivative of the output probability curve,e.g., the sigmoid or softmax curve of the probability values, and addsnoise or perturbations at the ends of the curve, near the maximum andminimum values of the curve, up to +/− half the range from the minimumvalue to the maximum value, e.g., in the case of a softmax or sigmoidprobability value curve that ranges from 0% to 100%, the noise orperturbations have a magnitude of up to +/−0.5. As mentioned previouslyabove, the particular perturbation function utilized may take manydifferent forms including those previously listed above and others thatmeet the criteria and guidelines mentioned above.

The resulting modified output vector provides modified probabilityvalues while maintaining the correctness of the classification andassociated labels that are associated with the input data in a labeleddata set. Thus, correct classification and labeling of the input dataset is still performed while obfuscating the actual trainedconfiguration of the trained model logic 360. The resulting classifiedor labeled data set may be provided to further stages of processingdownstream in the pipeline 306 for further processing and performance ofthe overall cognitive operation for which the cognitive system 300 isemployed.

Thus, an attacker, such as a user of client computing device 310 or thelike, is not able to submit a plurality of input data sets, obtaincorresponding labeled output data sets and corresponding probabilityvalues of output vectors, and thereby train their own trained models toaccurately replicate the training of the trained model logic 360 byutilizing the labeled data set and its associated probability values inthe vector output as training data. To the contrary, doing so wouldresult in a model that provides significantly lower performance thanthat of the trained model logic 360 resulting in a need to continue toutilize the trained model logic 360. In the case where a serviceprovider charges a fee for utilization of the cognitive system 300and/or trained model logic 360, this will result in a continued revenuestream for the service provider. Moreover, an attacker is not able todetermine the gradient of the trained model logic 360 so as to determinemisclassification noise that can cause the trained model logic 360 tomisclassify an input data set, i.e. cannot successfully perform a modelevasion attack. Thus, for example, the attacker cannot circumventsecurity systems using such trained model logic 360 by causing the modelto classify an image as an authorized user image when in face the imageis not associated with an authorized user. Moreover, as another example,the attacker cannot cause the system to operate incorrectly based on amisclassified input data, e.g., an automated vehicle braking system notbeing activated because an onboard image system misclassifies a stopsign as a speed limit sign.

It should be appreciated that while FIG. 3 illustrates theimplementation of the trained model logic 360 as part of a cognitivesystem 300, the illustrative embodiments are not limited to such.Rather, in some illustrative embodiments, the trained model logic 360itself may be provided as a service from which a user of a clientcomputing device 310, may request processing of an input data set.Moreover, other providers of services, which may include other cognitivesystems, may utilize such a trained model 360 to augment the operationof their own cognitive systems. Thus, in some illustrative embodimentsthe trained model logic 360 may be implemented in one or more servercomputing devices, accessed via one or more APIs via other computingdevices through which input data sets are submitted to the trained modellogic 360, and corresponding labeled data sets are returned. Thus, theintegration of the mechanisms of the illustrative embodiments into acognitive system 300 is not required, but may be performed depending onthe desired implementation.

As noted above, the mechanisms of the illustrative embodiments arerooted in the computer technology arts and are implemented using logicpresent in such computing or data processing systems. These computing ordata processing systems are specifically configured, either throughhardware, software, or a combination of hardware and software, toimplement the various operations described above. As such, FIG. 4 isprovided as an example of one type of data processing system in whichaspects of the present invention may be implemented. Many other types ofdata processing systems may be likewise configured to specificallyimplement the mechanisms of the illustrative embodiments.

FIG. 4 is a block diagram of an example data processing system in whichaspects of the illustrative embodiments are implemented. Data processingsystem 400 is an example of a computer, such as server computing device304 or client computing device 310 in FIG. 3, in which computer usablecode or instructions implementing the processes for illustrativeembodiments of the present invention are located. In one illustrativeembodiment, FIG. 4 represents a server computing device, such as aserver 304, which, which implements a cognitive system 300 and requestor QA system pipeline 308 augmented to include the additional mechanismsof the illustrative embodiments described herein with regard to aperturbation insertion engine for protecting the trained neural network,machine learning, deep learning, or other artificial intelligence modellogic from model stealing attacks.

In the depicted example, data processing system 400 employs a hubarchitecture including north bridge and memory controller hub (NB/MCH)402 and south bridge and input/output (I/O) controller hub (SB/ICH) 404.Processing unit 406, main memory 408, and graphics processor 410 areconnected to NB/MCH 402. Graphics processor 410 is connected to NB/MCH402 through an accelerated graphics port (AGP).

In the depicted example, local area network (LAN) adapter 412 connectsto SB/ICH 404. Audio adapter 416, keyboard and mouse adapter 420, modem422, read only memory (ROM) 424, hard disk drive (HDD) 426, CD-ROM drive430, universal serial bus (USB) ports and other communication ports 432,and PCI/PCIe devices 434 connect to SB/ICH 404 through bus 438 and bus440. PCI/PCIe devices may include, for example, Ethernet adapters,add-in cards, and PC cards for notebook computers. PCI uses a card buscontroller, while PCIe does not. ROM 424 may be, for example, a flashbasic input/output system (BIOS).

HDD 426 and CD-ROM drive 430 connect to SB/ICH 404 through bus 440. HDD426 and CD-ROM drive 430 may use, for example, an integrated driveelectronics (IDE) or serial advanced technology attachment (SATA)interface. Super I/O (SIO) device 436 is connected to SB/ICH 404.

An operating system runs on processing unit 406. The operating systemcoordinates and provides control of various components within the dataprocessing system 400 in FIG. 4. As a client, the operating system is acommercially available operating system such as Microsoft® Windows 10®.An object-oriented programming system, such as the Java™ programmingsystem, may run in conjunction with the operating system and providescalls to the operating system from Java™ programs or applicationsexecuting on data processing system 400.

As a server, data processing system 400 may be, for example, an IBM®eServer™ System p® computer system, running the Advanced InteractiveExecutive (AIX®) operating system or the LINUX® operating system. Dataprocessing system 400 may be a symmetric multiprocessor (SMP) systemincluding a plurality of processors in processing unit 406.Alternatively, a single processor system may be employed.

Instructions for the operating system, the object-oriented programmingsystem, and applications or programs are located on storage devices,such as HDD 426, and are loaded into main memory 408 for execution byprocessing unit 406. The processes for illustrative embodiments of thepresent invention are performed by processing unit 406 using computerusable program code, which is located in a memory such as, for example,main memory 408, ROM 424, or in one or more peripheral devices 426 and430, for example.

A bus system, such as bus 438 or bus 440 as shown in FIG. 4, iscomprised of one or more buses. Of course, the bus system may beimplemented using any type of communication fabric or architecture thatprovides for a transfer of data between different components or devicesattached to the fabric or architecture. A communication unit, such asmodem 422 or network adapter 412 of FIG. 4, includes one or more devicesused to transmit and receive data. A memory may be, for example, mainmemory 408, ROM 424, or a cache such as found in NB/MCH 402 in FIG. 4.

Those of ordinary skill in the art will appreciate that the hardwaredepicted in FIGS. 3 and 4 may vary depending on the implementation.Other internal hardware or peripheral devices, such as flash memory,equivalent non-volatile memory, or optical disk drives and the like, maybe used in addition to or in place of the hardware depicted in FIGS. 3and 4. Also, the processes of the illustrative embodiments may beapplied to a multiprocessor data processing system, other than the SMPsystem mentioned previously, without departing from the spirit and scopeof the present invention.

Moreover, the data processing system 400 may take the form of any of anumber of different data processing systems including client computingdevices, server computing devices, a tablet computer, laptop computer,telephone or other communication device, a personal digital assistant(PDA), or the like. In some illustrative examples, data processingsystem 400 may be a portable computing device that is configured withflash memory to provide non-volatile memory for storing operating systemfiles and/or user-generated data, for example. Essentially, dataprocessing system 400 may be any known or later developed dataprocessing system without architectural limitation.

FIG. 5 illustrates an example of a cognitive system processing pipelinewhich, in the depicted example, is a question and answer (QA) systempipeline used to process an input question in accordance with oneillustrative embodiment. As noted above, the cognitive systems withwhich the illustrative embodiments may be utilized are not limited to QAsystems and thus, not limited to the use of a QA system pipeline. FIG. 5is provided only as one example of the processing structure that may beimplemented to process a natural language input requesting the operationof a cognitive system to present a response or result to the naturallanguage input.

The QA system pipeline of FIG. 5 may be implemented, for example, as QApipeline 308 of cognitive system 300 in FIG. 3. It should be appreciatedthat the stages of the QA pipeline shown in FIG. 5 are implemented asone or more software engines, components, or the like, which areconfigured with logic for implementing the functionality attributed tothe particular stage. Each stage is implemented using one or more ofsuch software engines, components or the like. The software engines,components, etc. are executed on one or more processors of one or moredata processing systems or devices and utilize or operate on data storedin one or more data storage devices, memories, or the like, on one ormore of the data processing systems. The QA pipeline of FIG. 5 isaugmented, for example, in one or more of the stages to implement theimproved mechanism of the illustrative embodiments described hereafter,additional stages may be provided to implement the improved mechanism,or separate logic from the pipeline 300 may be provided for interfacingwith the pipeline 300 and implementing the improved functionality andoperations of the illustrative embodiments.

As shown in FIG. 5, the QA pipeline 500 comprises a plurality of stages510-580 through which the cognitive system operates to analyze an inputquestion and generate a final response. In an initial question inputstage 510, the QA pipeline 500 receives an input question that ispresented in a natural language format. That is, a user inputs, via auser interface, an input question for which the user wishes to obtain ananswer, e.g., “Who are Washington's closest advisors?” In response toreceiving the input question, the next stage of the QA pipeline 500,i.e. the question and topic analysis stage 520, parses the inputquestion using natural language processing (NLP) techniques to extractmajor features from the input question, and classify the major featuresaccording to types, e.g., names, dates, or any of a plethora of otherdefined topics. For example, in the example question above, the term“who” may be associated with a topic for “persons” indicating that theidentity of a person is being sought, “Washington” may be identified asa proper name of a person with which the question is associated,“closest” may be identified as a word indicative of proximity orrelationship, and “advisors” may be indicative of a noun or otherlanguage topic.

In addition, the extracted major features include key words and phrasesclassified into question characteristics, such as the focus of thequestion, the lexical answer type (LAT) of the question, and the like.As referred to herein, a lexical answer type (LAT) is a word in, or aword inferred from, the input question that indicates the type of theanswer, independent of assigning semantics to that word. For example, inthe question “What maneuver was invented in the 1500 s to speed up thegame and involves two pieces of the same color?,” the LAT is the string“maneuver.” The focus of a question is the part of the question that, ifreplaced by the answer, makes the question a standalone statement. Forexample, in the question “What drug has been shown to relieve thesymptoms of ADD with relatively few side effects?,” the focus is “drug”since if this word were replaced with the answer, e.g., the answer“Adderall” can be used to replace the term “drug” to generate thesentence “Adderall has been shown to relieve the symptoms of ADD withrelatively few side effects.” The focus often, but not always, containsthe LAT. On the other hand, in many cases it is not possible to infer ameaningful LAT from the focus.

The classification of the extracted features from the input question maybe performed using one or more trained models 525 which may beimplemented, for example, as neural network models, machine learningmodels, deep learning models, or other type of artificial intelligencebased model. As noted above, the mechanisms of the illustrativeembodiments may be implemented at the question and topic analysis stage520 with regard to the classification of the extracted features of theinput question by such trained models 525. That is, as the trained model525 operates on the input data, e.g., the extracted features from theinput question, to classify the input data, prior to output of thevector output, the perturbation insertion engine 590 of the illustrativeembodiments may operate to introduce perturbations into the probabilityvalues generated in the output vector while maintaining the accuracy ofthe classification as discussed above. Thus, while correctclassification is still provided downstream along the QA system pipeline500, any attacker obtaining access to the output vector probabilityvalues for purposes of training their own model using a model stealingattack, would be presented with inaccurate probability values thatresult in any model trained on such probability values providing lowerperformance than the trained model 525.

It should be appreciated that the input data, in some illustrativeembodiments, need not be a formulated request or question, eitherstructure or unstructured, but instead may simply be an input data setthat is input with the implied request that the input data set beprocessed by the pipeline 500. For example, in embodiments where thepipeline 500 is configured to perform image analysis cognitiveoperations, input images may be provided as input to the pipeline 500which extracts major features of the input images, classifies themaccording to the trained model 525, and performs other processing of thepipeline 500 as described hereafter to score the hypotheses as to whatis shown in the image, to thereby generate a final result output. Inother cases, audio input data may also be analyzed in a similar manner.Regardless of the nature of the input data being processed, themechanisms of the illustrative embodiments may be employed to insertperturbations in the probability values associated with theclassification operations performed by the trained models 525 so as toobfuscate the training of the trained models.

Referring again to FIG. 5, the identified major features are then usedduring the question decomposition stage 530 to decompose the questioninto one or more queries that are applied to the corpora ofdata/information 545 in order to generate one or more hypotheses. Thequeries are generated in any known or later developed query language,such as the Structure Query Language (SQL), or the like. The queries areapplied to one or more databases storing information about theelectronic texts, documents, articles, websites, and the like, that makeup the corpora of data/information 545. That is, these various sourcesthemselves, different collections of sources, and the like, represent adifferent corpus 547 within the corpora 545. There may be differentcorpora 547 defined for different collections of documents based onvarious criteria depending upon the particular implementation. Forexample, different corpora may be established for different topics,subject matter categories, sources of information, or the like. As oneexample, a first corpus may be associated with healthcare documentswhile a second corpus may be associated with financial documents.Alternatively, one corpus may be documents published by the U.S.Department of Energy while another corpus may be IBM Redbooks documents.Any collection of content having some similar attribute may beconsidered to be a corpus 547 within the corpora 545.

The queries are applied to one or more databases storing informationabout the electronic texts, documents, articles, websites, and the like,that make up the corpus of data/information, e.g., the corpus of data306 in FIG. 3. The queries are applied to the corpus of data/informationat the hypothesis generation stage 540 to generate results identifyingpotential hypotheses for answering the input question, which can then beevaluated. That is, the application of the queries results in theextraction of portions of the corpus of data/information matching thecriteria of the particular query. These portions of the corpus are thenanalyzed and used, during the hypothesis generation stage 540, togenerate hypotheses for answering the input question. These hypothesesare also referred to herein as “candidate answers” for the inputquestion. For any input question, at this stage 540, there may behundreds of hypotheses or candidate answers generated that may need tobe evaluated.

The QA pipeline 500, in stage 550, then performs a deep analysis andcomparison of the language of the input question and the language ofeach hypothesis or “candidate answer,” as well as performs evidencescoring to evaluate the likelihood that the particular hypothesis is acorrect answer for the input question. As mentioned above, this involvesusing a plurality of reasoning algorithms, each performing a separatetype of analysis of the language of the input question and/or content ofthe corpus that provides evidence in support of, or not in support of,the hypothesis. Each reasoning algorithm generates a score based on theanalysis it performs which indicates a measure of relevance of theindividual portions of the corpus of data/information extracted byapplication of the queries as well as a measure of the correctness ofthe corresponding hypothesis, i.e. a measure of confidence in thehypothesis. There are various ways of generating such scores dependingupon the particular analysis being performed. In generally, however,these algorithms look for particular terms, phrases, or patterns of textthat are indicative of terms, phrases, or patterns of interest anddetermine a degree of matching with higher degrees of matching beinggiven relatively higher scores than lower degrees of matching.

Thus, for example, an algorithm may be configured to look for the exactterm from an input question or synonyms to that term in the inputquestion, e.g., the exact term or synonyms for the term “movie,” andgenerate a score based on a frequency of use of these exact terms orsynonyms. In such a case, exact matches will be given the highestscores, while synonyms may be given lower scores based on a relativeranking of the synonyms as may be specified by a subject matter expert(person with knowledge of the particular domain and terminology used) orautomatically determined from frequency of use of the synonym in thecorpus corresponding to the domain. Thus, for example, an exact match ofthe term “movie” in content of the corpus (also referred to as evidence,or evidence passages) is given a highest score. A synonym of movie, suchas “motion picture” may be given a lower score but still higher than asynonym of the type “film” or “moving picture show.” Instances of theexact matches and synonyms for each evidence passage may be compiled andused in a quantitative function to generate a score for the degree ofmatching of the evidence passage to the input question.

Thus, for example, a hypothesis or candidate answer to the inputquestion of “What was the first movie?” is “The Horse in Motion.” If theevidence passage contains the statements “The first motion picture evermade was ‘The Horse in Motion’ in 1878 by Eadweard Muybridge. It was amovie of a horse running,” and the algorithm is looking for exactmatches or synonyms to the focus of the input question, i.e. “movie,”then an exact match of “movie” is found in the second sentence of theevidence passage and a highly scored synonym to “movie,” i.e. “motionpicture,” is found in the first sentence of the evidence passage. Thismay be combined with further analysis of the evidence passage toidentify that the text of the candidate answer is present in theevidence passage as well, i.e. “The Horse in Motion.” These factors maybe combined to give this evidence passage a relatively high score assupporting evidence for the candidate answer “The Horse in Motion” beinga correct answer.

It should be appreciated that this is just one simple example of howscoring can be performed. Many other algorithms of various complexitymay be used to generate scores for candidate answers and evidencewithout departing from the spirit and scope of the present invention.

In the synthesis stage 560, the large number of scores generated by thevarious reasoning algorithms are synthesized into confidence scores orconfidence measures for the various hypotheses. This process involvesapplying weights to the various scores, where the weights have beendetermined through training of the statistical model employed by the QApipeline 500 and/or dynamically updated. For example, the weights forscores generated by algorithms that identify exactly matching terms andsynonym may be set relatively higher than other algorithms that areevaluating publication dates for evidence passages. The weightsthemselves may be specified by subject matter experts or learned throughmachine learning processes that evaluate the significance ofcharacteristics evidence passages and their relative importance tooverall candidate answer generation.

The weighted scores are processed in accordance with a statistical modelgenerated through training of the QA pipeline 500 that identifies amanner by which these scores may be combined to generate a confidencescore or measure for the individual hypotheses or candidate answers.This confidence score or measure summarizes the level of confidence thatthe QA pipeline 500 has about the evidence that the candidate answer isinferred by the input question, i.e. that the candidate answer is thecorrect answer for the input question.

The resulting confidence scores or measures are processed by a finalconfidence merging and ranking stage 570 which compares the confidencescores and measures to each other, compares them against predeterminedthresholds, or performs any other analysis on the confidence scores todetermine which hypotheses/candidate answers are the most likely to bethe correct answer to the input question. The hypotheses/candidateanswers are ranked according to these comparisons to generate a rankedlisting of hypotheses/candidate answers (hereafter simply referred to as“candidate answers”). From the ranked listing of candidate answers, atstage 580, a final answer and confidence score, or final set ofcandidate answers and confidence scores, are generated and output to thesubmitter of the original input question via a graphical user interfaceor other mechanism for outputting information.

Thus, the illustrative embodiments provide mechanisms for protectingtrained artificial intelligence or cognitive models, such as neuralnetwork model, from model stealing attacks. The illustrative embodimentsintroduce perturbations, or noise, in the probability values output bythe trained models such that an attacker's calculation of gradientsbased on the output probability values is deviated from the correctdirection and magnitude while minimizing loss in the accuracy of thetrained model's classification or labeled data set. In some illustrativeembodiments, this result is achieved by using a perturbation functionthat reverses the sign of the first order derivative of the sigmoid orsoftmax function of the trained model and adds noise or perturbations atthe ends of the curve of the sigmoid or softmax function, near theminimum and maximum values of the curve. The result is that if anattacker uses the modified probability values output by the trainedmodel as a basis for training their own model, the resulting attackermodel will have less accuracy than the trained model it is attempting toreplicate, or the attacker (in the case of an evasion attack) is unableto generate noise to introduce into the input data that will cause theinput data to be misclassified by the trained model.

FIG. 6 is a flowchart outlining an example operation for obfuscating thetrained configuration of a trained model in the output vector of thetrained model in accordance with one illustrative embodiment. As shownin FIG. 6, the operation starts by receiving an input data set (step610). The input data set is processed by a trained model to generate aninitial set of output values (step 620). Perturbations are inserted intothe output values to modify the initial set of output values andgenerate a modified set of output values comprising introduced noiserepresented by the perturbations (step 630). The modified set of outputvalues are used to identify a classification and/or label for the inputdata set (step 640). The modified set of output values are used togenerate an augmented output set of data that is augmented to includelabels corresponding to the classification identified by the modifiedset of output values (step 650). The augmented (labeled) data set, whichmay include the modified set of output values, is then output (step660). Thereafter, the augmented (labeled) data set may be provided asinput to a cognitive computing operation engine that processes thelabeled data set to perform a cognitive operation (step 670). Theoperation then terminates.

It should be appreciated that while FIG. 6 includes steps 650-670 aspart of the example operation, the operation in some illustrativeembodiments, may end at step 640 and steps 650-670 need not be included.That is, rather than classification/labeling and cognitive computingoperation, as is performed in steps 650-670, the modified output values(step 640) may be output for use either by a user or other computingsystem. Thus, the user and/or other computing system may operate on themodified output values themselves and may not utilizeclassifications/labels as provided in steps 650-670.

Thus, the illustrative embodiments described above add small deceptiveperturbations to the output of the machine learning model, e.g., neuralnetwork, such that the loss surface changes to trap or deceive theattack with confusing gradients. In the above illustrative embodiments,the noise (perturbations) introduced into the output (probability valuesfor classifications) of the trained model(s), e.g., neural networks,such as trained model(s) 525 in FIG. 5, by the perturbation insertionengine 320 in FIG. 3 or 590 in FIG. 5 to modify the initial set ofoutput values, and generate a modified set of output values, affects allof the classifications of the output. This may lead to a significantamount of noise being introduced into the model and hence may dilute themeaning of the returned probabilities. For example, suppose the originalprobability vector (output) is [1.0, 0, 0, 0, 0, 0, 0, 0, 0, 0], and theperturbation introduction of the illustrative embodiments above modifiesthe probability vector into [0.9, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1,0.1, 0.1] before normalization. Normalization makes the final perturbedprobability vector [0.5, 0.06, 0.06, 0.06, 0.06, 0.06, 0.06, 0.06, 0.06,0.06]. Thus, the top-1 probability 1.0 becomes a significantly smallervalue 0.5. This effect can be even more severe with a larger number ofclasses.

In order to minimize the amount of noise introduced into the trainedmodel as a whole, in further illustrative embodiments, rather thanintroducing perturbations to all of the probabilities in the output ofthe trained model, e.g., neural network, a selective introduction ofperturbations into select probability outputs may be performed. Theselective introduction of perturbations may be performed with regard toa predetermined subset of the classifications and/or the size or amountof perturbation may be modified for all or a selected subset of theclassifications. This selective insertion of perturbations and/orperturbation size modification may be performed dynamically. Moreover,this selective insertion of perturbations and/or perturbation sizemodification may be performed based on a variety of different dynamicmodification criteria such as a request pattern analysis prediction thata source of requests is an attacker, a requestor specified level ofacceptable model noise, a compensation based evaluation, aclassification subset selection algorithm based on a top-K analysis, orthe like. While example mechanisms will be described for selecting asubset of output classifications of a model into which to insertperturbations in the manner previously discussed above, and/or modifyingthe size or amount of the introduced perturbations, it should beappreciated that other criteria for selecting a subset of outputclassifications and/or modifying the size of introduced perturbationsmay be used without departing from the spirit and scope of the presentinvention.

A selective classification output perturbation engine is provided infurther illustrative embodiments that comprises logic for specifying asubset of classification outputs into which to insert perturbations inthe output of the trained model(s) and/or size of perturbation to insertinto the output of the trained model(s). The selective classificationoutput perturbation engine may be implemented, for example, as logicexternal to the trained model(s) and/or as an additional layer of logicnodes within the trained model(s), such as part of an additional layerof nodes just prior to the original output layer, and/or after theoriginal output layer which operates on the output classificationprobability values to determine which classification outputs into whichthe introduce perturbations and/or sizes of perturbations to introduceinto all or the selected subset of classification outputs. For example,in embodiments where the perturbations are inserted into all of theclassification output probability values, such as in the previouslydescribed embodiments above, the selective classification outputperturbation engine logic may operate as an additional layer prior tothe output layer of nodes of the trained model(s) so as to introduce theperturbations into the output probability values prior to the outputlayer, but with the size of the perturbations being determined based onthe operation of the selective classification output perturbationengine, as described hereafter.

In other illustrative embodiments, where the operation of the selectiveclassification output perturbation engine operation is dependent uponthe particular probability values for the various classificationsactually generated by the trained model(s), such as a selection of thetop-K classes based selection of classification outputs into which toinsert perturbations, where in order to select the top-K classes, thelogic needs to know which classifications are in the top-K classes, theselective classification output perturbation engine logic may beimplemented as a logic layer present in the trained model(s) after theoriginal output layer of logic and prior to an additional modifiedoutput layer of logic (nodes) of the trained model(s). In this case, theselective classification output perturbation engine logic operates onthe original output probability values generated by the trained model,determines which subset of classification probability output values intowhich to introduce the perturbation, and controls the perturbationinsertion engine to insert perturbations of a determined size and/orinto a selected subset of classification outputs, and causes the trainedmodel(s) to output the modified, or perturbed, output classificationprobabilities in a manner similar to that previously described above.

The operation of the selective classification output perturbation enginemay be dynamically based on dynamic perturbation modification criteriasuch that one or more of a size/amount of the introduced perturbationsand/or the particular classification probability output values output bythe trained model(s) into which the perturbations are inserted may bedynamically changed as the trained model(s) operate to process inputdata, such as input data provide by requests submitted to the cognitivecomputing system, pipeline, or the like. This dynamic operation of theselective classification output perturbation engine may dynamicallyadjust the application of perturbations to outputs of the trainedmodel(s) in response to predetermined situations or dynamic perturbationcriteria being met by current circumstances. For example, the dynamicadjustment of perturbations may comprise modifying the particularclasses of output probabilities into which the perturbations areintroduced such that the perturbations are not introduced into all ofthe output classes of the trained model(s) based on the dynamicperturbation criteria. As another example, the amount, or size, of theperturbations introduced into the output probability values for all or aselected subset of the output probability values for classifications maybe dynamically modified based on the dynamic perturbation criteria.These dynamic modifications of the perturbations may be made based onvarious dynamic perturbation criteria, such as evaluation ofrequest/query patterns input to the trained model/neural network,cognitive computing system, or the like, an amount of noise in theoutputs of the trained model(s) acceptable to the user, compensationtiers, a classification subset selection algorithm based on a top-Kanalysis, or the like.

In some illustrative embodiments, the dynamic modification of theperturbations may be made based on a determined importance of theparticular input query. For example, a user may “opt-in” to paying ahigher cost to have their query or queries identified as relatively moreimportant than other queries by the same or different users. The moreimportant queries may be provided with more accurate results with lessperturbation, for example. In other illustrative embodiments, theperturbation may be dynamically modified on a per class basis based onthe relative importance of the particular class. For example, one ormore classifications may be defined as a “critical class” (relativelyhigher importance) while other classifications may be considered as notcritical classes (relatively lower importance), such as tuberculosis(versus a common cold class) in a medical classifier scenario. For thecritical (or important) classes, the amount of perturbation can bereduced to provide a more accurate result with regard to these criticalclasses such that a more accurate result may be provided to the medicalpractitioners with regard to the critical class.

FIG. 7 illustrates an example of a cognitive system processing pipelinein which selective classification output perturbation is performed inaccordance with one illustrative embodiment. FIG. 7 is similar to thatof FIG. 5 but with the addition of the selective classification outputperturbation engine 710 and the perturbation selection data storage 720which are utilized by further illustrative embodiments to controlselective introduction of perturbations by the perturbation insertionengine 590. While the logic of engines 710 and 590 are shown as separatefrom the trained model(s) 525, it should be appreciated that the logicmay be integrated into each other, such as a modified perturbationinsertion engine 590 comprising the logic of engine 710, or evencombined into the logic of the trained model(s) 525 as additional logiclayers prior to and/or after an original output layer of the trainedmodel(s) 525, as discussed herein. Elements in FIG. 7 having referencenumerals corresponding to those of FIG. 5 operate in a similar manner asdescribed previously unless otherwise indicated hereafter. It shouldalso be appreciated that the mechanisms of these further illustrativeembodiments are likewise not limited to use with cognitive computingsystems or with QA pipelines, but may be implemented with any trainedmodel(s) performing classification operations.

As shown in FIG. 7, in addition to the mechanisms previously describedabove with regard to FIG. 5, the further illustrative embodimentsinclude a selective classification output perturbation engine 710 whichoperates in concert with the perturbation insertion engine 590 so as tocontrol the perturbation insertion performed by the perturbationinsertion engine 590 to minimize the introduction of noise into thetrained model(s) 525 while achieving the protections previouslydescribed above with regard to model stealing attacks and adversarialexamples. That is, the perturbation insertion engine 590 of theillustrative embodiments operates to introduce perturbations into theprobability values generated in the output vector while maintaining theaccuracy of the classification as discussed above. However, theselective classification output perturbation engine 710 operates tominimize the amount of noise introduced due to the perturbationinsertion by selecting at least one of a size of the introduceperturbations or a subset of classification outputs into which theperturbations are introduced, while maintaining the accuracy of theclassifications. Thus, while correct classification is still provideddownstream along the QA system pipeline 500, any attacker obtainingaccess to the output vector probability values for purposes of trainingtheir own model using a model stealing attack and/or adversarialexamples, would be presented with inaccurate probability values thatresult in any model trained on such probability values providing lowerperformance than the trained model 525.

As with the previous illustrative embodiments, the perturbationinsertion engine 590 operates to insert perturbations into the outputprobabilities generated by the trained model (s) 525 such that gradientscalculated for points along a curve represented by the outputprobabilities deviate from a correct direction and amount and alsominimize accuracy loss in the modified output classifications andcorresponding labels. In some illustrative embodiments, the perturbationinsertion engine 525 meets these criteria by using a perturbationfunction that reverses the sign of the first order derivative of theoutput probability curve, e.g., the sigmoid or softmax curve of theprobability values, and adds noise or perturbations at the ends of thecurve, near the maximum and minimum values of the curve, up to +/− halfthe range from the minimum value to the maximum value, e.g., in the caseof a softmax or sigmoid probability value curve that ranges from 0% to100%, the noise or perturbations have a magnitude of up to +/−0.5. Asmentioned previously above, the particular perturbation functionutilized may take many different forms including those previously listedabove and others that meet the criteria and guidelines mentioned above.

The resulting modified output vector provides modified probabilityvalues while maintaining the correctness of the classification andassociated labels that are associated with the input data in a labeleddata set. Thus, correct classification and labeling of the input dataset is still performed while obfuscating the actual trainedconfiguration of the trained model(s) 525. The resulting classified orlabeled data set may be provided to further stages of processingdownstream in the pipeline 500, such as to question and topic analysis520, for further processing and performance of the overall cognitiveoperation for which the cognitive system is employed.

Thus, an attacker is not able to submit a plurality of input data sets,obtain corresponding labeled output data sets and correspondingprobability values of output vectors, and thereby train their owntrained models to accurately replicate the training of the trainedmodel(s) 525 by utilizing the labeled data set and its associatedprobability values in the vector output as training data. To thecontrary, doing so would result in a model that provides significantlylower performance than that of the trained model(s) 525 resulting in aneed to continue to utilize the trained model(s) 525.

In the further illustrative embodiment shown in FIG. 7, the selectiveclassification output perturbation engine 710 operates to control theperturbation insertion engine 590 to instruct the perturbation insertionengine 590 as to the size of perturbation to introduce into one or moreof the classification output probabilities and/or which classificationoutput probabilities into which to insert the perturbations. Theselection performed by the selective classification output perturbationengine 710 may be performed based on various selection criteria andselection data which may come from the input requests/queries processedby the trained model(s) 525, e.g., requests/queries input to the QApipeline 500, the original output probability values generated by thetrained model(s) 525, and/or data stored in perturbation selection datastorage 720. As the selection performed by the selective classificationoutput perturbation engine 710 may take many different forms, thefollowing description will set forth examples of selection methodologiesand logic implemented by various illustrative embodiments of theselective classification output perturbation engine 710, however itshould be appreciated that other methodologies and logic may beimplemented, as will become apparent to those of ordinary skill in theart in view of the present description, without departing from thespirit and scope of the present invention.

In some illustrative embodiments, the perturbation selection datastorage 720 stores data that serves as a basis for performing selectionof classification output probability values into which to insertperturbations and/or to select a size of perturbations to insert intothe output probabilities of the trained model(s) 525. For example, theperturbation selection data storage 720 stores data indicating sourcesof requests, patterns of input data submitted by sources of requests,and the like. Moreover, the perturbation selection data storage 720 maystore a register of registered owners/operators of the cognitivecomputing system, e.g., QA pipeline 500 and/or trained model(s) 525,which may include information specifying a desired selection methodologyto implement for requests/input data from users (sources), a level ofacceptable noise in the output probabilities of the trained model(s), asubscription or compensation level associated with an owner/operatorwhich may be mapped to a size of perturbation introduced into thecorresponding trained model(s) 525 and/or particular selectionmethodology to use to select a subset of probability value outputs intowhich to insert perturbations (noise), and the like. The registry mayalso store information about users (sources) to determine if users(sources) of requests are likely attackers or require heightenedscrutiny. In some illustrative embodiments, the perturbation selectiondata storage 720 may not be provided and the selective classificationoutput perturbation engine 710 may operate for all sources in the samemanner, e.g., for all users (sources), the top-K output probabilityvalues will have perturbation insertion performed, where K is the samevalue for all users (sources).

In one illustrative embodiment, the selective classification outputperturbation engine 710 operates based on a top-K selection methodologywhich selects the top-K ranked output probability values in the originaloutput values generated by the trained model(s) 525 into which to insertthe generated perturbations. For example, if K is “5”, then the top 5ranked output probability values will have their original outputprobability values perturbed by the insertion of perturbations by theperturbation insertion engine 590. The selective classification outputperturbation engine 710 may receive the original output values generatedby the trained model(s) 525 by processing the input data and may selectthe K highest valued output probability value classes to be the onesinto which the perturbation insertion engine 590 will insertperturbations, rather than inserting perturbations into all of theoutput probability values of the trained model(s) 525. Thus, forexample, if the original output probability values generated by thetrained model 525 for classes C1, C2, C3, C4, C5, C6, C7, C8, C9, andC10 are 0.92, 0.72, 0.05, 0.12, 0.45, 0.32, 0.68, 0.22, 0.10, and 0.06,respectively, then for a K value of 4, the top-K selection methodologywill select classes C1, C2, C5, and C7 as the classes into which theperturbations are inserted into their respective probability outputvalues by the perturbation insertion engine 590 as these are the top-4ranked output probability values in the set.

The selected class output probability values may be identified byselective classification output perturbation engine 710 based on theoriginal output probability values generated by the trained model(s) 525and control signals or output sent to the perturbation insertion engine590 to instruct the perturbation insertion engine 590 which outputprobability values into which to insert the perturbations. Theperturbation insertion engine 590 will then perform its operations, suchas previously described above, with regard to the selected subset ofclassification output probability values so as to cause the trainedmodel(s) 525 to output modified output probability values with regardthe selected subset of classification output probability values.

By inserting the perturbation into only a selected subset of the outputprobability values for selected classes, the amount of noise introducedinto the output of the trained model(s) 525 may be minimized while stillbeing able to thwart any model stealing and/or adversarial example basedattacks. That is, the overall amount of noise introduced into theoutputs of the trained model(s) 525 is minimized while maintaining theutility of the output of the trained model(s) 525. However, even withthe minimized introduction of noise, the effectiveness of the defenseoffered by the introduction of perturbations to thwart model stealingand adversarial example based attacks is still achieved since theclasses into which the modified output probability values, generated bythe trained model(s) 525 due to the introduction of the perturbationsinto the top-K output probability values, misclassifies will be one ofthe top-K classes that are affected by the deceptive perturbation.

It should be appreciated that the value of K is a tunable parameter,tunable between K=0 and K=max(K), with a potentially defined default Kvalue for the desired implementation, and the K value utilized by theselective classification output perturbation engine 710 may be selectedbased on a desired implementation of the illustrative embodiments. Thevalue of K may be fixed, or in some illustrative embodiments, K may bedynamically tunable based on a variety of different perturbationselection data which may be obtained from the input request, input dataset being processed, output of the trained model(s), and/or data storedin the perturbation selection data storage 720, for example. Forexample, the selective classification output perturbation engine 710 mayreceive source identification information, session information, and/orcharacteristic information for the input requests/data sets beingsubmitted to the cognitive computing system and/or trained model(s) 525,from the input requests, and may receive stored information from theperturbation selection data storage 720, and may dynamically determine avalue of K to use in the top-K selection algorithm based on an analysisof one or more of these data. For example, in some illustrativeembodiments, the selective classification output perturbation engine 710may perform pattern analysis logic on the input data of one or morerequests from the same source to determine if the pattern isrepresentative of an attack on the trained model(s) 525 and/or thecognitive computing system as a whole. This pattern analysis may makeuse of stored information in the perturbation selection data storage720. This stored information may include requests received from the samesource during a same session, multiple sessions, over a predeterminedperiod of time, or the like.

The selective classification output perturbation engine 710 may use aclassification model, such as another trained neural network or thelike, operating on various features extracted from the inputrequest/data set, a history of requests/data sets received from the samesource, or the like, to evaluate features of the requests and input datasets to predict whether an input request from a source is part of anattack on the trained model(s) 525. For example, if the same source hassent a large number of requests, or a large data set, with similar inputdata, e.g., images, for classification, over a predetermined period oftime, within the same session, or the like, then this may be indicativeof an attack. If the source is located in certain geographical areasknown to be areas where attacks have emanated from, as may be determinedfrom an IP address or the like, then the selective classification outputperturbation engine 710 may determine that the request is likely part ofan attack or has a high probability of being associated with an attack.If the source is not a registered source, then heightened scrutiny maybe applicable and thus, the engine 710 may determine a high likelihoodthat the request is part of an attack. Other analysis of characteristicsof the request and/or input data may be performed to evaluate alikelihood that the request is part of an attack.

If the request/input data is determined to likely be part of an attack,e.g., a prediction value equal to or greater than a predeterminedthreshold, then increased noise may be input to the output probabilityvalues generated by the trained model(s) 525. This increase in noiseintroduction may be to increase the value of K than would otherwise beutilized, e.g., if a default K value is 4, the value of K may beincreased to 10 or all output classifications. As can be seen, thismodification of the amount of noise introduced into the output of thetrained model(s) 525 may be performed dynamically based on an evaluationof the request/input data sets being received and an evaluation of thesources of the requests.

The dynamic modification of the amount of noise introduced into theoutput of the trained model(s) 525 by the perturbation insertion engine590 is not limited to predicting whether requests/data sets areassociated with attacks, but may also be performed based on trainedmodel(s) 525 owners/operators desired level of noise introductionthrough the insertion of perturbations. This desired level may bedetermined based on a registry of trained model owner informationmaintained as part of the perturbation selection data storage 720. Forexample, different trained model(s) 525 owners/operators may wantdifferent levels of protection for their trained model(s) 525, which maybe based on operating performance, an amount of protection that theowners/operators can afford from a financial perspective, or the like.For example, owners/operators may want to have more or less protectionsbased on desired performance of the trained model(s) 525. For thoseowners/operators that want increased protections, relatively higheramounts of noise may be introduced into the output probability valuesgenerated by their trained model(s) 525, e.g., increased K value, abovea default K value, in the top-K algorithm described above. For thoseowners/operators that do not want increased protections, either thedefault noise or lower amounts of noise may be introduced into theoutput probability values generated by their trained model(s) 525, e.g.,default K value or decreased K value, below the default K value, in thetop-K algorithm described above.

In some illustrative embodiments, different tiers of protection may beprovided with different costs to trained model 525 owners/operators.Thus, if an owner/operator subscribes to a higher tier levelcorresponding to a higher level of protection, more noise may beintroduced into the outputs of their trained model(s) than in lowerlevel protections or a higher performance may be achieved than for lowerlevel protection tiers. Alternatively, higher tiers may be associatedwith a more selective input of noise into the trained model(s) such thatowners/operators that subscribe to lower tiers will have more noiseintroduced, e.g., the same size perturbations introduced to all outputclassification probability values, while owners/operators that subscribeto higher tiers may have minimized inserted noise, i.e. a selectiveclassification output perturbation in accordance with the furtherillustrative embodiments is performed.

Thus, depending on the particular implementation, differentcustomizations of the dynamic selection of classification outputprobability values into which to insert perturbations may be achieved.The customization may be based on the particular trained model(s) 525being used to process the input request/data set. For example, if therequest targets or requests a particular operation that is performed bya particular trained model 525, the corresponding owner/operatorinformation from the registry stored in the perturbation selection datastorage 720 may be retrieved, by the selective classification outputperturbation engine 710, and used along with the original output valuesfrom the trained model(s) 525) to determine which top-K outputprobability values into which to insert perturbations. This informationis then used to generate a control signal or output to the perturbationinsertion engine 590 to cause the perturbation insertion engine 590 toperform the perturbation insertion with regard to the selected subset ofoutput classification probability values to thereby generate themodified classification probability values.

In other illustrative embodiments, the size or amount of theperturbation inserted into the classification output probability valuesgenerated by the trained model(s) 525 may be modified so as to minimizethe amount of noise introduced overall to the output of the trainedmodel 525. For example, the size/amount of the perturbation may beincreased/decreased based on various criteria, such as those discussedabove for dynamically modifying the K value for a top-K algorithm basedon source, owner/operator registry information, pattern analysisindicating likelihood that the request is part of an attack, or thelike. For example, using a top-K approach such as described previously,the top-K original output values may be identified and the perturbationsinserted into these top-K original output values may be increased whileall other original output values will have a smaller size/amount ofperturbation inserted into their original output probability values,e.g., top-K values have perturbations increased by 0.05 while all othervalues have perturbations decreased by 0.05 from a default perturbationsize/amount. Alternatively, if an owner/operator subscribes to a highertier of protection, increased size perturbations may be utilized thanfor owners/operators that subscribe to relatively lower tiers ofprotection. Various customizations of the size of perturbations may beperformed so as to control the amount of noise introduced into theoutputs of the trained model(s) 525 may be performed without departingfrom the spirit and scope of the present invention.

Moreover, the customizations and dynamic modifications may be performedwith regard to both size/amount of perturbations as well as the subsetof classification output probability values to which the perturbationsare inserted. These customizations may again be based on the particularoriginal output values generated by the trained model(s) 525,request/input data set characteristics extracted from the receivedrequests flowing into the cognitive computing system and/or trainedmodel(s) 525, and/or the stored information in the perturbationselection data storage 720. Thus, larger or smaller size perturbationsmay be introduced into outputs of the trained models 525 based onwhether or not the source is likely considered to be an attacker, therequest/input data set is likely considered to be an attacker, thesubscriber's preferences for levels of noise insertion into the outputsof the trained model(s) 525, or the like. Moreover, more or fewer classprediction outputs may have inserted perturbations (noise) based onwhether or not the source is likely considered to be an attacker, therequest/input data set is likely considered to be an attacker, thesubscriber's preferences for levels of noise insertion into the outputsof the trained model(s) 525, or the like.

It should be appreciated that the perturbation selection data storage720 may store the preferences of the owners/operators of the trainedmodel(s) 525 with regard to whether to use one or both types ofperturbation (noise) insertion controls and the extent to which to useone or both of these types of perturbation insertion controls. Forexample, preferences may be stored in the registry of data storage 720indicating that a particular owner/operator may want to use only top-Kselection controls of the perturbation insertion engine, and may specifya desired or default K value with criteria for determining if and whento modify the K value by increasing/decreasing, e.g., criteria fordetermining if a request is part of an attack. For anotherowner/operator of the trained model(s) 525, different preferences and/orcriteria for dynamically modifying the controlling the perturbationinsertion may be specified, e.g., use both top-K selection andperturbation size controls with specified criteria forincreasing/decreasing K and/or increasing/decreasing perturbation size.The selective classification output perturbation engine 710 may retrievethe appropriate registry entries for the corresponding trained model(s)525 being used to process the request/input data set and generatecorresponding perturbation insertion control signals or outputs sentfrom the selective classification output perturbation engine 710 to theperturbation insertion engine 590.

In some illustrative embodiments, the dynamic controlling of theperturbation insertion so as to customize the inserted noise in theoutputs of the trained model(s) 525 may be based on a determinedimportance of the received request/data set. With such mechanisms,relatively more important requests/data sets will have relatively loweramounts of noise introduced into the outputs of the trained model(s) 525by performing selective classification output perturbation so selecteither a subset of classification output probability values to introduceperturbations into, modify a size of the perturbations to reduce thesize of the perturbations so as to reduce noise, or both. As notedpreviously, the “importance” of requests/data sets (or queries) may bebased on various factors, including, for example, a user marking therequests/data sets with a higher rating or ranking (different tiers ofrequests/data sets) and potentially paying a premium cost for relativelymore important requests/data sets. In some embodiments, a predeterminedlist of critical classes, or “important” classes (again different“tiers” of importance), may be defined and the importance of arequest/data set may be determined based on these importance tiers. Forexample, a top tier classifications (e.g., “cancer”, “heart attack”,“stroke”, etc.) may have no perturbation introduced, whereas lower tierclassifications (e.g., “tuberculosis”, “flu”, etc.) may have smallperturbations introduced. The lowest tier classifications, e.g., “cold”,may have larger perturbations (more noise) introduced. For differenttiers, a function or a predefined scaling factor may be provided to addthe perturbation such that 0 indicates adding no perturbation and 1indicates adding full, or a maximum, perturbation.

It should be kept in mind that, for any of the dynamically modifiedperturbation selections or customizations, the amount of reduction islimited to a level where model stealing attacks or adversarial examplebased attacks (evasion attacks) are still thwarted by the gradientdeception mechanisms of the illustrative embodiments. Thus, there is arange of noise within which the dynamic modification of the insertedperturbations may be adjusted, e.g., a range comprising an upper limitwhere too much noise is introduced to allow proper classificationoutputs by the trained machine learning model(s) and a lower limit wheretoo little noise is introduced to adequately thwart attacks.Theoretically, for top “k” embodiments, k can be equal to or greaterthan 1. The defensive effect of the illustrative embodiments should bethere for k=1 as the gradient toward or away from the top-1 class can bestill deceptive in this case. As k increases, the number of such classeswith deceptive directions increases. For model evasion and stealing, themost informative direction is top-1 class. So, the effect is stillthere. The size of perturbation depends on the particular method toinject such noise, which may be determined empirically.

While a top-K selection and perturbation size controls are describedabove, it should be appreciated that various embodiments of the presentinvention may implement other controls for modifying the amount of noiseintroduced without departing from the spirit and scope of the presentinvention. In fact, in some illustrative embodiments, whether to addnoise or not as a whole can be an option. For example, as describedpreviously, a top-tier query can have no perturbation while lower tiercan have noise to all classes. Moreover, in some embodiments, ifimportant or critical classes are defined, noise (perturbations) may beselectively applied to non-important classes only.

In another embodiment, dynamic control of the introduction ofperturbations can be based on risk assessment. For example, a querypattern analysis engine or artificial intelligence (AI) model mayanalyze a sequence of queries (requests/input data sets) originatingfrom the same source to determine if the pattern represents a potentialmalicious action. For example, adversarial example generation typicallyrequires querying similar images multiple times. As a source submitsmore queries with similar images, e.g., multiple images of stop signswithin a predetermined period of time, within the same session, or thelike, the query pattern analysis engine or AI model can detect thispattern and control the perturbation insertion engine to gradually addmore noise, e.g., larger perturbations, or increase k in a top-K basedmechanism, so as to increase noise in queries suspected of being part ofan attack on the trained model, e.g., a model stealing attack or anevasion attack.

In some embodiments, instead of top-K based mechanism, a predefine setof critical or important classes, or all/nothing, the mechanisms of theillustrative embodiments may also add noise to a random set of classes.That is, the particular classes to which noise is introduced may bedetermined dynamically and randomly but while still maintaining theamount of noise introduced into the model as a whole to be at anacceptable level. For example, in some embodiments, a predeterminednumber of classes may be selected for introduction of noise, however theparticular classes selected may not be known a priori. In short, anymechanism that allows for the selection of a subset of classes intowhich noise is introduced, and/or the selection of different levels ofperturbation to be introduced, may be used without departing from thespirit and scope of the present invention.

Thus, these further illustrative embodiments provide mechanisms forminimizing the amount of noise introduced into the outputs of thetrained model(s) 525 by the insertion of perturbations into the outputsof the trained model(s) 525 by the perturbation insertion engine 590.The minimization of noise helps to avoid the problems with dilution ofthe output classification probability values discussed above whilemaintaining the utility of the gradient deception mechanisms to thwartmodel stealing attacks and adversarial example based attacks. The amountof noise minimization may be a tunable characteristic of theillustrative embodiments and may be tuned according to static or dynamiccriteria, such as model owner/operator preferences, subscription orother compensation levels, importance of requests/data sets beingprocessed, patterns of activity indicative of likelihood ofrequests/data sets being part of an attack, evaluation of sources ofrequests/data sets with regard to likelihood of the sources beingattackers, etc.

FIG. 8 is a flowchart outlining an example operation of a furtherillustrative embodiment in which dynamic modification of perturbationinsertion is performed. The operation outlined in FIG. 8 may beperformed, for example, by the selective classification outputperturbation engine 710 in FIG. 7, for example, in concert with theperturbation insertion engine 590 so as to control the size ofperturbations inserted into the output classification probability valuesgenerated by the trained model(s) 525 and/or the insertion ofperturbations to a selected subset of output classification probabilityvalues generated by the trained model(s) 525).

As shown in FIG. 8, the operation starts by receiving a request toprocess an input data set, which may also be provided or may otherwisebe accessed as a result of the request (step 810). The input data set isprocessed by a trained model to generate an initial set of output values(step 820). Characteristics of the received request, e.g., sourceidentifier (IP address, name of user, etc.), session identifier,requested classification operation to be performed, importance indicatorof the request, etc., and/or characteristics of the input data set,e.g., number and types of data being processed, e.g., types of images orthe like, may be extracted from the request/input data set and providesas input to the selective classification perturbation engine along withthe initial set of output values generated by the model (step 830). Asubset of classification outputs to perturb and/or a size ofperturbation to introduce into the output classification probabilityvalues is determined based on the extracted characteristics and theinitial set of output values (step 840). This operation may take manydifferent forms depending on the type of customization and dynamicmodifications enabled by the particular selected embodiment and itsimplementation. For example, top-K analysis may be performed to selectthe top K classification outputs, in the initial set of outputs, toperturb with the insertion of perturbations, where the value of K may bea fixed value or a value determined dynamically based on other factorsas previously described above. Moreover, source information may be usedto predict whether the source is likely an attacker, and owner/operatorinformation may be evaluated to determine a desired level of noise tointroduce into the outputs of the model.

After determining the controls on the perturbation insertion in step840, the perturbation insertion engine is controlled to insert theperturbations of the selected size and/or into the selected subset ofoutputs to generate a modified set of output values (step 850). Themodified set of output values are used to identifyclassifications/labels for the input data set (step 860) and generate anaugmented output set of data that is augmented to include labelscorresponding to the classification identified by the modified set ofoutput values (step 870). The augmented (labeled) data set, which mayinclude the modified set of output values, is then output (step 880).Thereafter, the augmented (labeled) data set may be provided as input toa cognitive computing operation engine that processes the labeled dataset to perform a cognitive operation (step 890). The operation thenterminates.

It should be appreciated that while FIG. 8 includes steps 860-890 aspart of the example operation, the operation in some illustrativeembodiments, may end at step 850 and steps 860-890 need not be included.That is, rather than classification/labeling and cognitive computingoperation, as is performed in steps 860-890, the modified output values(step 850) may be output for use either by a user or other computingsystem. Thus, the user and/or other computing system may operate on themodified output values themselves and may not utilizeclassifications/labels as provided in steps 860-890.

As noted above, it should be appreciated that the illustrativeembodiments may take the form of an entirely hardware embodiment, anentirely software embodiment or an embodiment containing both hardwareand software elements. In one example embodiment, the mechanisms of theillustrative embodiments are implemented in software or program code,which includes but is not limited to firmware, resident software,microcode, etc.

A data processing system suitable for storing and/or executing programcode will include at least one processor coupled directly or indirectlyto memory elements through a communication bus, such as a system bus,for example. The memory elements can include local memory employedduring actual execution of the program code, bulk storage, and cachememories which provide temporary storage of at least some program codein order to reduce the number of times code must be retrieved from bulkstorage during execution. The memory may be of various types including,but not limited to, ROM, PROM, EPROM, EEPROM, DRAM, SRAM, Flash memory,solid state memory, and the like.

Input/output or I/O devices (including but not limited to keyboards,displays, pointing devices, etc.) can be coupled to the system eitherdirectly or through intervening wired or wireless I/O interfaces and/orcontrollers, or the like. I/O devices may take many different formsother than conventional keyboards, displays, pointing devices, and thelike, such as for example communication devices coupled through wired orwireless connections including, but not limited to, smart phones, tabletcomputers, touch screen devices, voice recognition devices, and thelike. Any known or later developed I/O device is intended to be withinthe scope of the illustrative embodiments.

Network adapters may also be coupled to the system to enable the dataprocessing system to become coupled to other data processing systems orremote printers or storage devices through intervening private or publicnetworks. Modems, cable modems and Ethernet cards are just a few of thecurrently available types of network adapters for wired communications.Wireless communication based network adapters may also be utilizedincluding, but not limited to, 802.11 a/b/g/n wireless communicationadapters, Bluetooth wireless adapters, and the like. Any known or laterdeveloped network adapters are intended to be within the spirit andscope of the present invention.

The description of the present invention has been presented for purposesof illustration and description, and is not intended to be exhaustive orlimited to the invention in the form disclosed. Many modifications andvariations will be apparent to those of ordinary skill in the artwithout departing from the scope and spirit of the describedembodiments. The embodiment was chosen and described in order to bestexplain the principles of the invention, the practical application, andto enable others of ordinary skill in the art to understand theinvention for various embodiments with various modifications as aresuited to the particular use contemplated. The terminology used hereinwas chosen to best explain the principles of the embodiments, thepractical application or technical improvement over technologies foundin the marketplace, or to enable others of ordinary skill in the art tounderstand the embodiments disclosed herein.

What is claimed is:
 1. A method for obfuscating a trained configurationof a trained machine learning model, the method being performed in adata processing system comprising at least one processor and at leastone memory, the at least one memory comprising instructions executed bythe at least one processor to specifically configure the at least oneprocessor to implement the trained machine learning model and aperturbation insertion engine, the method comprising: processing, by thetrained machine learning model having a machine learning trainedconfiguration, input data to generate an initial output vector havingclassification values for each of a plurality of predefined classes;determining, by the perturbation insertion engine, a subset ofclassification values in the initial output vector into which to insertperturbations, wherein the subset of classification values is less thanall of the classification values in the initial output vector;modifying, by the perturbation insertion engine, classification valuesin the subset of classification values by inserting a perturbation in afunction associated with generating the output vector for theclassification values in the subset of classification values, to therebygenerate a modified output vector; and outputting, by the trainedmachine learning model, the modified output vector, wherein theperturbation modifies the subset of classification values to obfuscatethe trained configuration of the trained machine learning model whilemaintaining accuracy of classification of the input data.
 2. The methodof claim 1, further comprising: determining, by the selectiveclassification output perturbation engine, a size of a perturbation toinsert into the subset of classification values.
 3. The method of claim2, wherein at least one of determining the subset of classificationvalues in the output vector into which to insert perturbations ordetermining the size of the perturbation to insert into the subset ofclassification values comprises evaluating characteristics of at leastone of a request submitting the input data, the input data itself, or anoperator of the trained machine learning model, to dynamically determinethe subset of classification values or the size of the perturbation. 4.The method of claim 1, wherein determining the subset of classificationvalues in the output vector into which to insert perturbations comprisesevaluating characteristics of at least one of a request submitting theinput data, the input data itself, or an operator of the trained machinelearning model, to dynamically determine the subset of classificationvalues.
 5. The method of claim 4, wherein evaluating the characteristicscomprises evaluating the characteristics to determine a probability thatthe request or input data is part of an attack on the trained machinelearning model, and wherein the subset of classification values isdetermined based on results of determining the probability that therequest or input data is part of an attack on the trained machinelearning model.
 6. The method of claim 5, wherein determining theprobability that the request or input data is part of an attackcomprises at least one of determining whether the source of the requestor input data is located in a geographic area associated with attackers,determining whether a pattern of activity associated with the source isindicative of an attack on the trained machine learning model, ordetermining whether or not the source is a previously registered user ofthe trained machine learning model.
 7. The method of claim 1, whereindetermining the subset of classification values in the output vectorinto which to insert perturbations comprises performing a top-K analysisof the classification values in the initial output vector, where K isone of a fixed predetermined integer value or a dynamically determinedinteger value.
 8. The method of claim 7, wherein K is a dynamicallydetermined integer value, and wherein a value of K is determined basedon at least one of one or more characteristics of a request submittingthe input data, characteristics of the input data, or characteristics ofan operator of the trained machine learning model.
 9. The method ofclaim 1, wherein inserting the perturbation in the function associatedwith generating the output vector comprises inserting a perturbationthat changes a sign or a magnitude of a gradient of the output vector.10. The method of claim 1, wherein modifying classification values inthe subset of classification values by inserting a perturbation in thefunction associated with generating the output vector for theclassification values in the subset of classification values comprisesadding noise to an output of the function up to a maximum value,positive or negative, that does not modify the classification of theinput data.
 11. A computer program product comprising a non-transitorycomputer readable medium having a computer readable program storedtherein, wherein the computer readable program, when executed on a dataprocessing system, causes the data processing system to implement atrained machine learning model and a perturbation insertion engine,which operate to: receive, by the trained machine learning model, inputdata for classification into one or more classes in a plurality ofpredefined classes as part of a cognitive operation of the cognitivesystem; process, by the trained machine learning model, the input datato generate an initial output vector having classification values foreach of the plurality of predefined classes; determine, by the selectiveclassification output perturbation engine, a subset of classificationvalues in the initial output vector into which to insert perturbations,wherein the subset of classification values is less than all of theclassification values in the initial output vector; modify, by theperturbation insertion engine, classification values in the subset ofclassification values by inserting a perturbation in a functionassociated with generating the output vector for the classificationvalues in the subset of classification values, to thereby generate amodified output vector; and output, by the trained machine learningmodel, the modified output vector, wherein the perturbation modifies thesubset of classification values to obfuscate the trained configurationof the trained machine learning model while maintaining accuracy ofclassification of the input data.
 12. The computer program product ofclaim 11, wherein the computer readable program further causes the dataprocessing system to: determine, by the selective classification outputperturbation engine, a size of a perturbation to insert into the subsetof classification values.
 13. The computer program product of claim 12,wherein at least one of determining the subset of classification valuesin the output vector into which to insert perturbations or determiningthe size of the perturbation to insert into the subset of classificationvalues comprises evaluating characteristics of at least one of a requestsubmitting the input data, the input data itself, or an operator of thetrained machine learning model, to dynamically determine the subset ofclassification values or the size of the perturbation.
 14. The computerprogram product of claim 11, wherein the computer readable programfurther causes the data processing system to determine the subset ofclassification values in the output vector into which to insertperturbations at least by evaluating characteristics of at least one ofa request submitting the input data, the input data itself, or anoperator of the trained machine learning model, to dynamically determinethe subset of classification values.
 15. The computer program product ofclaim 14, wherein the computer readable program further causes the dataprocessing system to evaluate the characteristics at least by evaluatingthe characteristics to determine a probability that the request or inputdata is part of an attack on the trained machine learning model, andwherein the subset of classification values is determined based onresults of determining the probability that the request or input data ispart of an attack on the trained machine learning model.
 16. Thecomputer program product of claim 15, wherein the computer readableprogram further causes the data processing system to determine theprobability that the request or input data is part of an attack at leastby at least one of determining whether the source of the request orinput data is located in a geographic area associated with attackers,determining whether a pattern of activity associated with the source isindicative of an attack on the trained machine learning model, ordetermining whether or not the source is a previously registered user ofthe trained machine learning model.
 17. The computer program product ofclaim 11, wherein the computer readable program further causes the dataprocessing system to determine the subset of classification values inthe output vector into which to insert perturbations at least byperforming a top-K analysis of the classification values in the initialoutput vector, where K is one of a fixed predetermined integer value ora dynamically determined integer value.
 18. The computer program productof claim 17, wherein K is a dynamically determined integer value, andwherein a value of K is determined based on at least one of one or morecharacteristics of a request submitting the input data, characteristicsof the input data, or characteristics of an operator of the trainedmachine learning model.
 19. The computer program product of claim 11,wherein the computer readable program further causes the data processingsystem to insert the perturbation in the function associated withgenerating the output vector at least by inserting a perturbation thatchanges a sign or a magnitude of a gradient of the output vector.
 20. Anapparatus comprising: a processor; and a memory coupled to theprocessor, wherein the memory comprises instructions which, whenexecuted by the processor, cause the processor to implement a trainedmachine learning model and a perturbation insertion engine, whichoperate to: receive, by the trained machine learning model, input datafor classification into one or more classes in a plurality of predefinedclasses as part of a cognitive operation of the cognitive system;process, by the trained machine learning model, the input data togenerate an initial output vector having classification values for eachof the plurality of predefined classes; determine, by the selectiveclassification output perturbation engine, a subset of classificationvalues in the initial output vector into which to insert perturbations,wherein the subset of classification values is less than all of theclassification values in the initial output vector; modify, by theperturbation insertion engine, classification values in the subset ofclassification values by inserting a perturbation in a functionassociated with generating the output vector for the classificationvalues in the subset of classification values, to thereby generate amodified output vector; and output, by the trained machine learningmodel, the modified output vector, wherein the perturbation modifies thesubset of classification values to obfuscate the trained configurationof the trained machine learning model while maintaining accuracy ofclassification of the input data.